GHSA-35fg-hjcr-j65f

Source

https://github.com/advisories/GHSA-35fg-hjcr-j65f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-35fg-hjcr-j65f/GHSA-35fg-hjcr-j65f.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-35fg-hjcr-j65f

Aliases

CVE-2022-23619

Published

2022-02-09T21:51:19Z

Modified

2023-11-01T04:57:58.276267Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Information exposure in xwiki-platform

Details

Impact

It's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users.

Patches

The problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1.

Workarounds

There's no easy workaround other than applying the upgrade.

References

https://jira.xwiki.org/browse/XWIKI-18787

For more information

If you have any questions or comments about this advisory: * Open an issue in JIRA * Email us at XWiki Security Mailing list

Database specific

{
    "nvd_published_at": "2022-02-09T21:15:00Z",
    "github_reviewed_at": "2022-02-09T21:51:19Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-200",
        "CWE-640"
    ]
}

References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-web

Package

Name: org.xwiki.platform:xwiki-platform-web; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-web

Affected ranges

Type: ECOSYSTEM
Events: Introduced

13.5RC1

Fixed

13.6RC1

Database specific

{
    "last_known_affected_version_range": "<= 13.5"
}

Maven / org.xwiki.platform:xwiki-platform-web

Package

Name: org.xwiki.platform:xwiki-platform-web; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-web

Affected ranges

Type: ECOSYSTEM
Events: Introduced

13.0.0

Fixed

13.4.1

Maven / org.xwiki.platform:xwiki-platform-web

Package

Name: org.xwiki.platform:xwiki-platform-web; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-web

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

12.10.9