PT-2021-19892 · Xwiki · Xwiki

Simon Urli · Published 2021-07-01 · Updated 2022-10-25 · CVE-2021-32731

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 13.1RC1 through 13.1

Description The reset password form reveals the email address of users just by giving their username. The problem has been patched on XWiki 13.2RC1.

Recommendations For versions 13.1RC1 through 13.1, manually modify the resetpasswordinline.vm to perform the changes made to mitigate the vulnerability. Update to XWiki 13.2RC1 or later to resolve the issue.

Fix

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-200

CWE-668

Related Identifiers

CVE-2021-32731

GHSA-H4M4-PGP4-WHGM

Affected Products

Xwiki

References · 8

• https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff#diff-14a3132e3986b1f5606dd13d9d8a8bb8634bec9932123c5e49e9604cfd850fc2 · Patch
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h4m4-pgp4-whgm · Patch
• https://osv.dev/vulnerability/GHSA-h4m4-pgp4-whgm · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-18400 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32731 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32731 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cibsecurity/25877 · Telegram Post