CVE-2021-32732

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-32732

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32732.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-32732

Aliases

GHSA-vh5c-jqfg-mhrh

Related

GHSA-vh5c-jqfg-mhrh

Published

2022-02-04T23:15:11.547Z

Modified

2026-04-11T17:25:54.743761Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tied to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check it's quite easy to perform a lot of those requests. ### Patches This issue has been patched in XWiki 12.10.5 and 13.2RC1. Two different patches are provided: - a first one to fix the CSRF problem - a more complex one that now relies on sending an email for the Forgot username process. ### Workarounds It's possible to fix the problem without uprading by editing the ForgotUsername page in version below 13.x, to use the following code: https://github.com/xwiki/xwiki-platform/blob/69548c0320cbd772540cf4668743e69f879812cf/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ForgotUsername.xml#L39-L123 In version after 13.x it's also possible to edit manually the forgotusername.vm file, but it's really encouraged to upgrade the version here. ### References * https://jira.xwiki.org/browse/XWIKI-18384 * https://jira.xwiki.org/browse/XWIKI-18408 ### For more information If you have any questions or comments about this advisory: * Open an issue in Jira XWiki * Email us at security ML

References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type

GIT

Repo

https://github.com/xwiki/xwiki-platform

Events

Introduced

Fixed

648a3522f7213ef0973ffc1ecc19f3237ace437e

Introduced

Last affected

909c4bf9b308cf9cab52bfed54adccd04bad5803

Introduced

Last affected

5e8b9d45b1a37ab1db65cd54e915960db993c6f2

Fixed

69548c0320cbd772540cf4668743e69f879812cf

Fixed

f0440dfcbba705e03f7565cd88893dde57ca3fa8

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "12.10.5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "13.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "13.1-NA"
        }
    ]
}

Affected versions

xwiki-platform-12.*

xwiki-platform-12.10

xwiki-platform-12.10.1

xwiki-platform-12.10.2

xwiki-platform-12.10.3

xwiki-platform-12.10.4

xwiki-platform-13.*

xwiki-platform-13.0

xwiki-platform-13.1

xwiki-platform-13.1-rc-1

xwiki-platform-7.*

xwiki-platform-7.3-milestone-2

xwiki-platform-7.4-milestone-1

xwiki-platform-7.4-milestone-2

xwiki-platform-8.*

xwiki-platform-8.0-milestone-1

xwiki-platform-8.0-milestone-2

xwiki-platform-8.1-milestone-1

xwiki-platform-8.1-milestone-2

xwiki-platform-8.2-milestone-1

xwiki-platform-8.2-milestone-2

xwiki-platform-8.3-milestone-1

xwiki-platform-9.*

xwiki-platform-9.9-rc-2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32732.json"

vanir_signatures_modified

"2026-04-11T17:25:54Z"

vanir_signatures

[
    {
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ForgotUsernameIT.java",
            "function": "retrieveUsername"
        },
        "signature_type": "Function",
        "digest": {
            "function_hash": "321511329396376669312218935850776368126",
            "length": 813.0
        },
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/f0440dfcbba705e03f7565cd88893dde57ca3fa8",
        "id": "CVE-2021-32732-09f5bee2"
    },
    {
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-pageobjects/src/main/java/org/xwiki/administration/test/po/ForgotUsernameCompletePage.java"
        },
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "251217306514859619729184700471186833448",
                "199229846389208028956009798926644344764",
                "213871815080359841772049817996547587366",
                "25879533808186726883246047470144874219",
                "62421165840151599138911258022246008760",
                "129694273408657017414493921345509943975",
                "337925841246286738380181249167885145737",
                "17579833428035848139847490700510753504",
                "270426981502098446807195555461356081428",
                "95988757209306918649795552561013156578",
                "197116577369363535185915315576975665036"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/f0440dfcbba705e03f7565cd88893dde57ca3fa8",
        "id": "CVE-2021-32732-11403701"
    },
    {
        "deprecated": false,
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ForgotUsernameIT.java"
        },
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "212167843153462203918438076222652165542",
                "267833405704134173463587126576270611872",
                "122256918115292340730976151278462974449",
                "253386088988216724541881939744350321869",
                "168528726115801181141102509399456729119",
                "229391438677786712981967939327372002714",
                "213961176082885187054766903672163231412",
                "187913529817686961733626460741875455451",
                "208974072341044210503438707672625612527",
                "191495375154641226014560563177148135448",
                "96747196774251497656021484790891097701",
                "121974007087520156669634355298007897279",
                "311733091909938625917041651662709887816",
                "75532339610968220336271361325290414112",
                "4963411913489212483806052763792358310",
                "27291694393317981520669052303345432939",
                "214383342098226394618605417062846361939",
                "260104887367736406406670934597730531264",
                "281505545462669323924397718938086921186",
                "237035295654585754746416190870919168424",
                "165856873151530329563790312359313904346",
                "318011033276162379696597374478739197271",
                "283648711470615106526451807124100147789",
                "174308907012048630077348165258308703677",
                "260774348310256504927679534918071333626",
                "80363895206049832292556761768904242199",
                "265916118567180192575691118640530936087",
                "46233985816664113650682750722701477674",
                "187012145170103017417385982936492599583",
                "108068986776790943876678393078647506132",
                "161812367812486087699225520824310043052",
                "326766680069370402729348557990253355991",
                "91079803178060339117565205667241073202",
                "273010000897075825769552332254042653601",
                "94568887412941441782799840804991332966"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "source": "https://github.com/xwiki/xwiki-platform/commit/f0440dfcbba705e03f7565cd88893dde57ca3fa8",
        "id": "CVE-2021-32732-589deacc"
    }
]