XWiki Platform suffers from a CWE-359 vulnerability where private personal information, specifically password hashes and salts, can be exposed to unauthorized actors. The flaw exists in versions starting from 6.2.1 up to but not including 16.10.17, 17.4.9, 17.10.13, and including 18.0.0-rc1. Attackers can exploit slightly modified parameters to the LiveTableResults feature to extract password hashes bit by bit, requiring approximately 768 requests to retrieve the full hash and salt. The vulnerability is a result of an insufficient patch for a prior issue (GHSA-5cf8-vrr8-8hjm). The vendor has adjusted the checks for password and email properties in the specified fixed versions. A manual patch can be applied to the XWiki.LiveTableResultsMacros wiki page as a workaround.

An attacker with network access can retrieve password hashes and salts of users by exploiting the LiveTableResults feature, potentially enabling offline password cracking. The vulnerability does not affect integrity or availability but compromises confidentiality of sensitive authentication data. The CVSS score of 7.5 reflects a high severity due to network attack vector, no required privileges or user interaction, and high confidentiality impact.

The vulnerability is fixed in XWiki Platform versions 16.10.17, 17.4.9, 17.10.13, and 18.0.0RC1 and later. Users should upgrade to one of these versions or later to remediate the issue. As a workaround, the patch can be manually applied to the XWiki.LiveTableResultsMacros wiki page to prevent exposure. No official vendor advisory or patch link is provided, so users should verify patch availability and instructions from the official XWiki sources.