CVE-2021-32620

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2021-32620
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32620.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-32620
Aliases
Related
Published
2021-05-28T21:15:08Z
Modified
2025-11-01T17:46:37.042588Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a user disabled on a wiki using email verification for registration canouldre-activate themself by using the activation link provided for his registration. The problem has been patched in the following versions of XWiki: 11.10.13, 12.6.7, 12.10.2, 13.0. It is possible to workaround the issue by resetting the validkey property of the disabled XWiki users. This can be done by editing the user profile with object editor.

References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
f15d9b0cb5a00e3e5be7086439228a642077090d
Fixed
04b39a6071d54116a2843cbc4dfd82df1d205000

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f9a677408ffb06f309be46ef9d8df1915d9099a4

Affected versions

xwiki-application-calendar-1.*

xwiki-application-calendar-1.0

xwiki-platform-7.*

xwiki-platform-7.3-milestone-2
xwiki-platform-7.4-milestone-1
xwiki-platform-7.4-milestone-2

xwiki-platform-8.*

xwiki-platform-8.0-milestone-1
xwiki-platform-8.0-milestone-2
xwiki-platform-8.1-milestone-1
xwiki-platform-8.1-milestone-2
xwiki-platform-8.2-milestone-1
xwiki-platform-8.2-milestone-2
xwiki-platform-8.3-milestone-1

xwiki-platform-9.*

xwiki-platform-9.9-rc-2

xwiki-plugin-tag-1.*

xwiki-plugin-tag-1.1

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "id": "CVE-2021-32620-60692a16",
        "signature_type": "Function",
        "digest": {
            "length": 1635.0,
            "function_hash": "74993982675903380300558167265386334505"
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/XWikiTest.java",
            "function": "testValidationKeyStorage"
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/f9a677408ffb06f309be46ef9d8df1915d9099a4",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2021-32620-cac56baf",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "166565996346234007952578434145113726337",
                "34829311102813294821476151928182488625",
                "249746745310220631589336637763246409542",
                "26767898319983850590131920081022792543"
            ]
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/XWikiTest.java"
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/f9a677408ffb06f309be46ef9d8df1915d9099a4",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2021-32620-e8ffd0b7",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "333884364067774965770896065528305408985",
                "237466027818441016518720692688188386773",
                "231454723608874196696161139047446081652",
                "54018045994974618111647359857516213772",
                "202616622984379918360185746959868606406",
                "189778971827438261842333342334267405657",
                "38538732939526166594164616750257449880",
                "62291361967030770090905944611693644655"
            ]
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java"
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/f9a677408ffb06f309be46ef9d8df1915d9099a4",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2021-32620-ff6d5e03",
        "signature_type": "Function",
        "digest": {
            "length": 1246.0,
            "function_hash": "290506542892366268742433191790491887891"
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/XWiki.java",
            "function": "validateUser"
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/f9a677408ffb06f309be46ef9d8df1915d9099a4",
        "deprecated": false
    }
]