GHSA-35fg-hjcr-j65f

    Dashboard / Vulnerabilities / GHSA-35fg-hjcr-j65f

    GHSA-35fg-hjcr-j65f

    Published: 9 Feb 2022Last Modified: 8 Nov 2023

    Summary: Information exposure in xwiki-platform

    Details: ### Impact It's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users. ### Patches The problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1. ### Workarounds There's no easy workaround other than applying the upgrade. ### References https://jira.xwiki.org/browse/XWIKI-18787 ### For more information If you have any questions or comments about this advisory: * Open an issue in [JIRA](https://jira.xwiki.org) * Email us at [XWiki Security Mailing list](mailto:[email protected])

    References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-35fg-hjcr-j65f, https://nvd.nist.gov/vuln/detail/CVE-2022-23619, https://github.com/xwiki/xwiki-platform/commit/d8a3cce48e0ac1a0f4a3cea7a19747382d9c9494, https://github.com/xwiki/xwiki-platform, https://jira.xwiki.org/browse/XWIKI-18787

    Affected packages

    Package

    Name: org.xwiki.platform:xwiki-platform-web

    Purl: pkg:maven/org.xwiki.platform/xwiki-platform-web

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 13.5RC1
    Fixed -13.6RC1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-35fg-hjcr-j65f | CVE-DB