Detections
Analytics

SCA: security update for org.xwiki.platform:xwiki-platform-administration-ui (GHSA-vh5c-jqfg-mhrh)

medium Tenable Self-Hosted Container Security Plugin ID 419346

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - ### Impact It's possible to know if a user has or not an account in a wiki related to an email address,
 and which username(s) is actually tied to that email by forging a request to the Forgot username page.
 Note that since this page does not have a CSRF check it's quite easy to perform a lot of those requests.
 ### Patches This issue has been patched in XWiki 12.10.5 and 13.2RC1. Two different patches are provided:
 - a first one to fix the CSRF problem - a more complex one that now relies on sending an email for the
 Forgot username process. ### Workarounds It's possible to fix the problem without uprading by editing the
 ForgotUsername page in version below 13.x, to use the following code: https://github.com/xwiki/xwiki-
 platform/blob/69548c0320cbd772540cf4668743e69f879812cf/xwiki-platform-core/xwiki-platform-
 administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ForgotUsername.xml#L39-L123 In
 version after 13.x it's also possible to edit manually the forgotusername.vm file, but it's really
 encouraged to upgrade the version here. ### References * https://jira.xwiki.org/browse/XWIKI-18384 *
 https://jira.xwiki.org/browse/XWIKI-18408 ### For more information If you have any questions or comments
 about this advisory: * Open an issue in [Jira XWiki](https://jira.xwiki.org) * Email us at [security
 ML](mailto:[email protected]) (CVE-2021-32732)

See Also

https://github.com/advisories/GHSA-vh5c-jqfg-mhrh

Plugin Details

Severity: Medium

ID: 419346

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.4

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2021-32732

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/10/2022

Vulnerability Publication Date: 2/4/2022

Reference Information

CVE: CVE-2021-32732

cwe: CWE-352