CVE-2021-32620: XWiki users registered with email verification can self re-activate their disabled accounts
Summary
CVE-2021-32620: XWiki users registered with email verification can self re-activate their disabled accounts. Affects org.xwiki.commons:xwiki-commons-core across 3 version ranges.
>= 11.6, < 11.10.13
>= 12.0, < 12.6.7
>= 12.10.0, < 12.10.2
Fixed in 11.10.13, 12.6.7 or 12.10.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki is an open-source platform for developing collaborative applications. It provides a wiki-based environment for creating and sharing content. The XWiki Commons Core package is a foundational component of XWiki, responsible for core functionalities and utilities. This package is vulnerable to a security issue that allows disabled users to re-activate their accounts using the activation link provided during registration.
Vulnerability Detail
The vulnerability arises when a user disabled on a wiki, which utilizes email verification for registration, can self re-activate their disabled account. By utilizing the activation link provided during registration, the user can bypass the account disabling mechanism. This can lead to unauthorized access and potential misuse of the re-activated account. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 11.6, < 11.10.1311.10.13 -
>= 12.0, < 12.6.712.6.7 -
>= 12.10.0, < 12.10.212.10.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not possible, a temporary workaround is available. The validkey property of disabled XWiki users can be reset manually by editing the user profile with an object editor. This will prevent users from self re-activating their disabled accounts.
Conclusion
In conclusion, XWiki users registered with email verification are susceptible to a vulnerability that allows them to self re-activate their disabled accounts. This can lead to unauthorized access and potential misuse. It is recommended to update XWiki to one of the patched versions or apply the provided workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.commons:xwiki-commons-core →
FAQ
XWiki is an open-source platform for developing collaborative applications, providing a wiki-based environment for creating and sharing content.
The XWiki Commons Core package is a foundational component of XWiki, responsible for core functionalities and utilities.
The vulnerability allows users who have been disabled on a wiki to re-activate their accounts using the activation link provided during registration. This can lead to unauthorized access and potential misuse of the re-activated account.
The vulnerability has a CVSS score of 8.8, indicating a high severity level.
The vulnerability can be fixed by updating XWiki to one of the patched versions: 11.10.13, 12.6.7, 12.10.2, or 13.0.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.commons:xwiki-commons-core.
