Detections
Analytics

SCA: security update for org.xwiki.platform:xwiki-platform-livetable-ui (GHSA-rh28-mqj4-8x59)

high Tenable Cloud Security Plugin ID 442365

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was
 insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17,
 with slightly modified parameters to the `LiveTableResults`, it is still possible to discover password
 hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a
 user. The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9
 and 16.10.17. As a workaround, the patch can be applied manually to the wiki page
 `XWiki.LiveTableResultsMacros`. (CVE-2026-48048)

Solution

Update the org.xwiki.platform:xwiki-platform-livetable-ui library and its related packages to version 16.10.17 or later.

See Also

https://github.com/advisories/GHSA-rh28-mqj4-8x59

Plugin Details

Severity: High

ID: 442365

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 5/26/2026

Updated: 8/11/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.72

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-48048

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/26/2026

Vulnerability Publication Date: 5/26/2026

Reference Information

CVE: CVE-2026-48048

cwe: CWE-359