CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 2CVE-2021-32732 – Cross-Site Request Forgery in xwiki-platform
https://notcve.org/view.php?id=CVE-2021-32732
### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tied to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check it's quite easy to perform a lot of those requests. ### Patches This issue has been patched in XWiki 12.10.5 and 13.2RC1. Two different patches are provided: - a first one to fix the CSRF problem - a more complex one that now relies on sending an email for the Forgot username process. ### Workarounds It's possible to fix the problem without uprading by editing the ForgotUsername page in version below 13.x, to use the following code: https://github.com/xwiki/xwiki-platform/blob/69548c0320cbd772540cf4668743e69f879812cf/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ForgotUsername.xml#L39-L123 In version after 13.x it's also possible to edit manually the forgotusername.vm file, but it's really encouraged to upgrade the version here. ### References * https://jira.xwiki.org/browse/XWIKI-18384 * https://jira.xwiki.org/browse/XWIKI-18408 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki](https://jira.xwiki.org) * Email us at [security ML](mailto:security@xwiki.org) ### Impacto Es posible saber si un usuario presenta o no una cuenta en un wiki relacionada con una dirección de correo electrónico, y qué nombre(s) de usuario está(n) realmente vinculado(s) a ese correo electrónico al falsificar una petición a la página de Nombre de usuario olvidado. Ten en cuenta que como esta página no presenta una comprobación de tipo CSRF es bastante fácil llevar a cabo muchas de esas peticiones. ### Parches Este problema ha sido parcheado en XWiki versiones 12.10.5 y 13.2RC1. Se proporcionan dos parches diferentes: - uno para corregir el problema de CSRF - otro más complejo que ahora es basado en el envío de un correo electrónico para el proceso Forgot username. ### Mitigaciones Es posible arreglar el problema sin actualizar al editar la página de ForgotUsername en versiones anteriores a 13.x, para usar el siguiente código: https://github.com/xwiki/xwiki-platform/blob/69548c0320cbd772540cf4668743e69f879812cf/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ForgotUsername.xml#L39-L123 En la versión posterior a 13.x también es posible editar manualmente el archivo forgotusername.vm, pero es recomendado actualizar la versión aquí. • https://github.com/xwiki/xwiki-platform/commit/69548c0320cbd772540cf4668743e69f879812cf https://github.com/xwiki/xwiki-platform/commit/f0440dfcbba705e03f7565cd88893dde57ca3fa8 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vh5c-jqfg-mhrh https://jira.xwiki.org/browse/XWIKI-18384 https://jira.xwiki.org/browse/XWIKI-18408 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.7EPSS: 0%CPEs: 4EXPL: 1CVE-2021-32730 – No CSRF protection on the password change form
https://notcve.org/view.php?id=CVE-2021-32730
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulnerability exists in versions prior to 12.10.5, and in versions 13.0 through 13.1. It's possible for forge an URL that, when accessed by an admin, will reset the password of any user in XWiki. The problem has been patched in XWiki 12.10.5 and 13.2RC1. As a workaround, it is possible to apply the patch manually by modifying the `register_macros.vm` template. • https://github.com/xwiki/xwiki-platform/commit/0a36dbcc5421d450366580217a47cc44d32f7257 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-v9j2-q4q5-cxh4 https://jira.xwiki.org/browse/XWIKI-18315 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-32729 – A user without PR can reset user authentication failures information
https://notcve.org/view.php?id=CVE-2021-32729
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 12.10.4, and 13.0. The script service method used to reset the authentication failures record can be executed by any user with Script rights and does not require Programming rights. An attacher with script rights who is able to reset the authentication failure record might perform a brute force attack, since they would be able to virtually deactivate the mechanism introduced to mitigate those attacks. The problem has been patched in version 12.6.8, 12.10.4 and 13.0. • https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m738-3rc4-5xv3 https://jira.xwiki.org/browse/XWIKI-18276 • CWE-693: Protection Mechanism Failure CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-32620 – Users registered with email verification can self re-activate their disabled accounts
https://notcve.org/view.php?id=CVE-2021-32620
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a user disabled on a wiki using email verification for registration canouldre-activate themself by using the activation link provided for his registration. The problem has been patched in the following versions of XWiki: 11.10.13, 12.6.7, 12.10.2, 13.0. It is possible to workaround the issue by resetting the `validkey` property of the disabled XWiki users. This can be done by editing the user profile with object editor. • https://github.com/xwiki/xwiki-platform/commit/f9a677408ffb06f309be46ef9d8df1915d9099a4 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-76mp-659p-rw65 https://jira.xwiki.org/browse/XWIKI-17942 • CWE-285: Improper Authorization CWE-863: Incorrect Authorization •
CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 1CVE-2021-32621 – Script injection without script or programming rights through Gadget titles
https://notcve.org/view.php?id=CVE-2021-32621
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 12.6.7 and 12.10.3, a user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard. The issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1. La Plataforma XWiki es una plataforma wiki genérica que ofrece servicios de ejecución para las aplicaciones construidas sobre ella. En las versiones anteriores a la versión 12.6.7 y 12.10.3, un usuario sin derecho de Script o Programación puede ejecutar un script que requiera privilegios al editar los títulos de los gadgets en el tablero. • https://github.com/xwiki/xwiki-platform/commit/bb7068bd911f91e5511f3cfb03276c7ac81100bc https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h353-hc43-95vc https://jay-from-future.github.io/cve/2021/06/17/xwiki-rce-cve.html https://jira.xwiki.org/browse/XWIKI-17794 • CWE-94: Improper Control of Generation of Code ('Code Injection') •