GitHub Advisoryadvisory · Maven

GHSA-v9j2-q4q5-cxh4 No CSRF protection on the password change form

MEDIUM Published 2021-07-02 Modified 2021-07-02 Official page ↗
Aliases
CVE-2021-32730
Ecosystem
Maven
Packages
org.xwiki.platform:xwiki-platform-administration-ui
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-352
Reviewed
2021-07-02

Affected packages

• Maven org.xwiki.platform:xwiki-platform-administration-ui: < 12.10.5 → fixed in 12.10.5 • Maven org.xwiki.platform:xwiki-platform-administration-ui: >= 13.0, < 13.2 → fixed in 13.2

Description

Impact It's possible for forge an URL that, when accessed by an admin, will reset the password of any user in XWiki. Patches The problem has been patched in XWiki 12.10.5, 13.2RC1. Workarounds It's possible to apply the patch manually by modifying the `register_macros.vm` template like in https://github.com/xwiki/xwiki-platform/commit/0a36dbcc5421d450366580217a47cc44d32f7257. References https://jira.xwiki.org/browse/XWIKI-18315 For more information If you have any questions or comments about this advisory: • Open an issue in Jira XWiki • Email us at security ML

Related

Alias · CVE (1)

  • CVE-2021-32730 XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References