Skip to content

No CSRF protection on the password change form

Moderate
surli published GHSA-v9j2-q4q5-cxh4 Jul 1, 2021

Package

maven org.xwiki.platform:xwiki-platform-administration-ui (Maven)

Affected versions

< 12.10.5, 13.0 and 13.1

Patched versions

12.10.5, 13.2RC1

Description

Impact

It's possible for forge an URL that, when accessed by an admin, will reset the password of any user in XWiki.

Patches

The problem has been patched in XWiki 12.10.5, 13.2RC1.

Workarounds

It's possible to apply the patch manually by modifying the register_macros.vm template like in 0a36dbc.

References

https://jira.xwiki.org/browse/XWIKI-18315

For more information

If you have any questions or comments about this advisory:

Severity

Moderate
5.7
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

CVE ID

CVE-2021-32730

Weaknesses