🛡️ CVE-2023-38509 — xwiki

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs low-level privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality low, integrity none, availability none.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

• Attack vector: Network — reachable from anywhere that can route to the service.
• Attack complexity: Low — the attack works reliably, with no preparation.
• Privileges required: Low — an ordinary user account is enough.
• User interaction: None — nobody has to be tricked into anything.
• Scope: Unchanged — the damage stays inside the vulnerable component.
• Confidentiality impact: Low — limited, and the attacker does not choose what is affected.
• Integrity impact: None.
• Availability impact: None.

Weakness class

CVE-2023-38509 is classified as CWE-402: Transmission of Private Resources into a New Sphere ('Resource Leak'). The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.

Affected software

CVE-2023-38509 is recorded against 2 packages.

• org.xwiki.platform:xwiki-platform-livetable-ui (from 15.0 up to 15.3-rc-1)
• xwiki (from 3.5 up to 14.10.9)

Timeline and source

Published on 27 July 2023 and last revised on 18 March 2024. No public exploit is currently recorded for this entry. A vendor advisory or fix has been published. Record sourced from NVD.

References

github.com (Web)
nvd.nist.gov (Advisory)
github.com (Web)
github.com (Web)
github.com (Package)
jira.xwiki.org (Web)

Other advisories for this package

org.xwiki.platform:xwiki-platform-livetable-ui has other advisories on record. If you are patching this one, these are worth checking on the same host:

• CVE-2026-48048 (8.0 High, published 26 May 2026)
• CVE-2023-34467 (8.0 High, published 20 Jun 2023)
• CVE-2023-26476 (8.0 High, published 3 Mar 2023)
• CVE-2022-41935 (published 21 Nov 2022)

Same weakness in other software

These advisories are the same class of weakness (CWE-402: Transmission of Private Resources into a New Sphere ('Resource Leak')) in other software:

• CVE-2025-48383 (8.2 High, published 7 Jul 2026)
• CVE-2025-67745 (7.1 High, published 18 Dec 2025)
• CVE-2024-32388 (5.3 Medium, published 1 Dec 2025)
• CVE-2025-66422 (4.3 Medium, published 30 Nov 2025)
• CVE-2025-55014 (4.7 Medium, published 4 Aug 2025)
• CVE-2025-49618 (5.8 Medium, published 3 Jul 2025)
• CVE-2025-52925 (5.0 Medium, published 2 Jul 2025)
• CVE-2025-32360 (4.2 Medium, published 5 Apr 2025)

Details

Affected Packages

References