GitHub Advisoryadvisory · Maven

GHSA-35fg-hjcr-j65f Information exposure in xwiki-platform

MEDIUM Published 2022-02-09 Modified 2022-02-09 Official page ↗
Aliases
CVE-2022-23619
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-web
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-640
Reviewed
2022-02-09

Affected packages

• Maven org.xwiki.platform:xwiki-platform-web: >= 13.5RC1, < 13.6RC1 → fixed in 13.6RC1 • Maven org.xwiki.platform:xwiki-platform-web: >= 13.0.0, < 13.4.1 → fixed in 13.4.1 • Maven org.xwiki.platform:xwiki-platform-web: < 12.10.9 → fixed in 12.10.9

Description

Impact It's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users. Patches The problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1. Workarounds There's no easy workaround other than applying the upgrade. References https://jira.xwiki.org/browse/XWIKI-18787 For more information If you have any questions or comments about this advisory: • Open an issue in JIRA • Email us at XWiki Security Mailing list

Related

Alias · CVE (1)

  • CVE-2022-23619 XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness

References