CVE-2021-32730

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-32730

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32730.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-32730

Aliases

GHSA-v9j2-q4q5-cxh4

Published

2021-07-01T18:15:07.733Z

Modified

2026-07-08T06:28:51.024038568Z

Severity

5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulnerability exists in versions prior to 12.10.5, and in versions 13.0 through 13.1. It's possible for forge an URL that, when accessed by an admin, will reset the password of any user in XWiki. The problem has been patched in XWiki 12.10.5 and 13.2RC1. As a workaround, it is possible to apply the patch manually by modifying the register_macros.vm template.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:xwiki:xwiki:13.1:rc1:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "introduced": "13.1-rc1"
                },
                {
                    "last_affected": "13.1-rc1"
                },
                {
                    "introduced": "13.1-rc1"
                },
                {
                    "last_affected": "13.1-rc1"
                }
            ],
            "vendor_product": "xwiki:xwiki"
        }
    ]
}

References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type

GIT

Repo

https://github.com/xwiki/xwiki-commons

Events

Introduced

Fixed

45cb44af6bd0775156a54e0a7e10804eb1689f5b

Introduced

271203deeb757a7c21e3c0623b79e7b3050c2a05

Last affected

1d2a35bb2773fe8b68f16a65c440beb65b3a49bf

Database specific

{
    "cpe": [
        "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:13.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:13.1:-:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "12.10.5"
        },
        {
            "introduced": "13.0"
        },
        {
            "last_affected": "13.0"
        },
        {
            "introduced": "13.1-NA"
        },
        {
            "last_affected": "13.1-NA"
        }
    ]
}

Affected versions

13.*

13.0

13.1-NA

xwiki-commons-12.*

xwiki-commons-12.10

xwiki-commons-12.10.1

xwiki-commons-12.10.2

xwiki-commons-12.10.3

xwiki-commons-12.10.4

xwiki-commons-13.*

xwiki-commons-13.1

xwiki-commons-13.1-rc-1

xwiki-commons-8.*

xwiki-commons-8.0-milestone-1

xwiki-commons-8.0-milestone-2

xwiki-commons-8.1-milestone-1

xwiki-commons-8.1-milestone-2

xwiki-commons-8.2-milestone-1

xwiki-commons-8.2-milestone-2

xwiki-commons-8.3-milestone-1

xwiki-commons-8.3-milestone-2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32730.json"

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type

GIT

Repo

https://github.com/xwiki/xwiki-platform

Events

Introduced

Fixed

648a3522f7213ef0973ffc1ecc19f3237ace437e

Introduced

909c4bf9b308cf9cab52bfed54adccd04bad5803

Last affected

5e8b9d45b1a37ab1db65cd54e915960db993c6f2

Fixed

0a36dbcc5421d450366580217a47cc44d32f7257

Database specific

{
    "cpe": [
        "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:13.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:13.1:-:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "12.10.5"
        },
        {
            "introduced": "13.0"
        },
        {
            "last_affected": "13.0"
        },
        {
            "introduced": "13.1-NA"
        },
        {
            "last_affected": "13.1-NA"
        }
    ]
}

Affected versions

13.*

13.0

13.1-NA

xwiki-platform-12.*

xwiki-platform-12.10

xwiki-platform-12.10.1

xwiki-platform-12.10.2

xwiki-platform-12.10.3

xwiki-platform-12.10.4

xwiki-platform-13.*

xwiki-platform-13.1

xwiki-platform-13.1-rc-1

xwiki-platform-7.*

xwiki-platform-7.3-milestone-2

xwiki-platform-7.4-milestone-1

xwiki-platform-7.4-milestone-2

xwiki-platform-8.*

xwiki-platform-8.0-milestone-1

xwiki-platform-8.0-milestone-2

xwiki-platform-8.1-milestone-1

xwiki-platform-8.1-milestone-2

xwiki-platform-8.2-milestone-1

xwiki-platform-8.2-milestone-2

xwiki-platform-8.3-milestone-1

xwiki-platform-9.*

xwiki-platform-9.9-rc-2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32730.json"