GHSA-35fg-hjcr-j65f

Suggest an improvement
Source
https://github.com/advisories/GHSA-35fg-hjcr-j65f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-35fg-hjcr-j65f/GHSA-35fg-hjcr-j65f.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-35fg-hjcr-j65f
Aliases
Published
2022-02-09T21:51:19Z
Modified
2023-11-08T04:08:25.203342Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Information exposure in xwiki-platform
Details

Impact

It's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users.

Patches

The problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1.

Workarounds

There's no easy workaround other than applying the upgrade.

References

https://jira.xwiki.org/browse/XWIKI-18787

For more information

If you have any questions or comments about this advisory: * Open an issue in JIRA * Email us at XWiki Security Mailing list

References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-web

Package

Name
org.xwiki.platform:xwiki-platform-web
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13.5RC1
Fixed
13.6RC1

Database specific

{
    "last_known_affected_version_range": "<= 13.5"
}

Maven / org.xwiki.platform:xwiki-platform-web

Package

Name
org.xwiki.platform:xwiki-platform-web
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13.0.0
Fixed
13.4.1

Maven / org.xwiki.platform:xwiki-platform-web

Package

Name
org.xwiki.platform:xwiki-platform-web
View open source insights on deps.dev
Purl
pkg:maven/org.xwiki.platform/xwiki-platform-web

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
12.10.9