CVE-2021-32730: No CSRF protection on the password change form in org.xwiki.platform:xwiki-platform-administration-ui
Summary
CVE-2021-32730: No CSRF protection on the password change form. Affects org.xwiki.platform:xwiki-platform-administration-ui across 2 version ranges.
< 12.10.5
>= 13.0, < 13.2
Fixed in 12.10.5 or 13.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
org.xwiki.platform:xwiki-platform-administration-ui is a Maven package that provides the administration UI for XWiki, an open-source wiki software. It allows administrators to manage various aspects of the XWiki application, including user accounts and permissions. This package is vulnerable to a CSRF (Cross-Site Request Forgery) attack on the password change form.
Vulnerability Detail
The vulnerability in org.xwiki.platform:xwiki-platform-administration-ui allows an attacker to forge a URL that, when accessed by an admin, can reset the password of any user in XWiki. This means that an unauthorized user can gain control over user accounts and potentially perform malicious actions. The lack of CSRF protection on the password change form makes it possible for an attacker to trick an admin into unknowingly changing the password of a targeted user.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 12.10.512.10.5 -
>= 13.0, < 13.213.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to the patched versions is not immediately feasible, a workaround is to manually apply the patch by modifying the 'register_macros.vm' template. The details of the patch can be found in the commit mentioned earlier.
Conclusion
The vulnerability in org.xwiki.platform:xwiki-platform-administration-ui allows an attacker to reset the password of any user in XWiki by exploiting the lack of CSRF protection on the password change form. To mitigate this vulnerability, it is crucial to update to the patched versions or apply the provided patch manually. Prompt action is recommended to prevent unauthorized access and potential misuse of user accounts. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-administration-ui →
FAQ
The vulnerability allows an attacker to reset the password of any user in XWiki by tricking an admin into accessing a specially crafted URL. This can lead to unauthorized access and potential misuse of user accounts.
To protect your XWiki installation, it is recommended to update to the patched versions (12.10.5 or 13.2RC1) or apply the patch manually. Additionally, it is important to be cautious when accessing URLs and to verify their authenticity before taking any actions.
There are no known public exploits of this vulnerability at the time of this advisory. However, it is always important to promptly apply security patches to mitigate the risk of potential exploits.
Yes, this vulnerability can be exploited remotely. An attacker can craft a URL and trick an admin into accessing it, leading to the password reset of a targeted user.
There is no evidence of active attacks exploiting this vulnerability at the time of this advisory. However, it is recommended to apply the necessary patches or workarounds to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-administration-ui.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
