cve/2023/CVE-2023-38509.md

### [CVE-2023-38509](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38509)
![](https://img.shields.io/static/v1?label=Product&message=xwiki-platform&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3E%3D%203.5-milestone-1%2C%20%3C%2014.10.9%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-402%3A%20Transmission%20of%20Private%20Resources%20into%20a%20New%20Sphere%20('Resource%20Leak')&color=brighgreen)

### Description

XWiki Platform is a generic wiki platform. In org.xwiki.platform:xwiki-platform-livetable-ui starting with version 3.5-milestone-1 and prior to versions 14.10.9 and 15.3-rc-1, the mail obfuscation configuration was not fully taken into account and is was still possible by obfuscated emails. This has been patched in XWiki 14.10.9 and XWiki 15.3-rc-1. A workaround is to modify the page `XWiki.LiveTableResultsMacros` following the patch.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/NaInSec/CVE-LIST