Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-20371

Solr search disclosed email addresses of users

    XMLWordPrintable

Details

    • Unit
    • Unknown
    • N/A
    • N/A

    Description

      SUBMISSION REFERENCES

      RESEARCHER INFORMATION

      • Submitter: ynoof

      SUBMISSION INFORMATION

      • Created at: Mon, 14 Nov 2022 14:51:34 GMT
      • Submission status: Archived

      REPORT CONTENT

      As mentioned in the wiki program the User profile data are not confidential except `email addresses` and passwords, I can view any email address for any user on the wiki.

          1. Steps to reproduce
            1. Go to the following endpoint:

      https://intigriti.xwiki.com/xwiki/bin/view/Main/SolrSearch

      2. Put the username in the search box, and you will see all emails that the user has.

          1. POC {542852}
      {354365} {882795}

      Thanks,
      Ynoof

      Attachments

        1. 882795_poc3.png
          882795_poc3.png
          71 kB
        2. 542852_poc1.png
          542852_poc1.png
          61 kB
        3. 354365_poc2.png
          354365_poc2.png
          62 kB

        Issue Links

          Activity

            People

              MichaelHamann Michael Hamann
              intigriti Intigriti Integration
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: