PT-2021-19892

CVE-2021-32731

Published

2021-07-01

Updated

2022-10-25

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 13.1RC1 through 13.1

Description The reset password form reveals the email address of users just by giving their username. The problem has been patched on XWiki 13.2RC1.

Recommendations For versions 13.1RC1 through 13.1, manually modify the resetpasswordinline.vm to perform the changes made to mitigate the vulnerability. Update to XWiki 13.2RC1 or later to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Simon Urli

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-668: Exposure of Resource to Wrong Sphere

Related identifiers

CVE-2021-32731