PT-2022-16132 · Xwiki · Xwiki Platform

Tmortagne · Published 2022-02-09 · Updated 2022-02-15 · CVE-2022-23619

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 12.10.9 XWiki Platform versions prior to 13.4.1 XWiki Platform versions prior to 13.6RC1

Description The issue allows an attacker to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users. There are no known workarounds for this issue.

Recommendations For versions prior to 12.10.9, update to version 12.10.9 or later. For versions prior to 13.4.1, update to version 13.4.1 or later. For versions prior to 13.6RC1, update to version 13.6RC1 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-640

Related Identifiers

CVE-2022-23619

GHSA-35FG-HJCR-J65F

Affected Products

Xwiki Platform

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23619.json · Exploit
• https://github.com/xwiki/xwiki-platform/commit/d8a3cce48e0ac1a0f4a3cea7a19747382d9c9494 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23619 · Security Note
• https://jira.xwiki.org/browse/XWIKI-18787 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23619 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-35fg-hjcr-j65f · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-35fg-hjcr-j65f · Note
• https://t.me/cibsecurity/37131 · Telegram Post
• https://t.me/cvenotify/26540 · Telegram Post