CVE-2021-32731
published 2021-07-01CVE-2021-32731: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13.1RC1 and 13.1, the…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
1.20%
64.4th percentile
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13.1RC1 and 13.1, the reset password form reveals the email address of users just by giving their username. The problem has been patched on XWiki 13.2RC1. As a workaround, it is possible to manually modify the `resetpasswordinline.vm` to perform the changes made to mitigate the vulnerability.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xwiki | xwiki | — | — |
| xwiki | xwiki-platform | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
The reset password form reveal users email address
ghsa·2021-07-02
CVE-2021-32731 [MEDIUM] CWE-200 The reset password form reveal users email address
The reset password form reveal users email address
### Impact
The reset password form reveals the email address of users just by giving their username.
### Patches
The problem has been patched on XWiki 13.2RC1.
### Workarounds
It's possible to manually modify the `resetpasswordinline.vm` to perform the changes made in https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff#diff-14a3132e3986b1f5606dd13d9d8a8bb8634bec9932123c5e49e9604cfd850fc2
### References
https://jira.xwiki.org/browse/XWIKI-18400
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xiwki.org)
* Email us at [Security ML](mailto:[email protected])
OSV
The reset password form reveal users email address
osv·2021-07-02
CVE-2021-32731 [MEDIUM] The reset password form reveal users email address
The reset password form reveal users email address
### Impact
The reset password form reveals the email address of users just by giving their username.
### Patches
The problem has been patched on XWiki 13.2RC1.
### Workarounds
It's possible to manually modify the `resetpasswordinline.vm` to perform the changes made in https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff#diff-14a3132e3986b1f5606dd13d9d8a8bb8634bec9932123c5e49e9604cfd850fc2
### References
https://jira.xwiki.org/browse/XWIKI-18400
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xiwki.org)
* Email us at [Security ML](mailto:[email protected])
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff#diff-14a3132e3986b1f5606dd13d9d8a8bb8634bec9932123c5e49e9604cfd850fc2https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h4m4-pgp4-whgmhttps://jira.xwiki.org/browse/XWIKI-18400https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff#diff-14a3132e3986b1f5606dd13d9d8a8bb8634bec9932123c5e49e9604cfd850fc2https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h4m4-pgp4-whgmhttps://jira.xwiki.org/browse/XWIKI-18400
2021-07-01
Published