CVE-2022-23619: Information Exposure in xwiki-platform-web
Summary
CVE-2022-23619: Information exposure in xwiki-platform. Affects org.xwiki.platform:xwiki-platform-web across 3 version ranges.
< 12.10.9
>= 13.0.0, < 13.4.1
>= 13.5RC1, < 13.6RC1
Fixed in 12.10.9, 13.4.1 or 13.6RC1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The xwiki-platform-web package is an open-source web application framework that provides a platform for building collaborative applications. It is written in Java and is commonly used for creating wikis and knowledge management systems. The package includes various modules and components for managing user accounts, content creation, and access control. However, a vulnerability has been discovered in the package that allows an attacker to guess if a user has an account on the wiki, even if the wiki is closed to guest users.
Vulnerability Detail
The vulnerability in xwiki-platform-web arises from the 'Forgot your password' form, which can be used to determine if a user account exists on the wiki. This information exposure can be exploited by an attacker to gather intelligence about potential targets and launch further attacks. The vulnerability affects versions 0 to 13.5 of the package. The impact of this vulnerability is considered moderate with a CVSS score of 5.3. The issue has been patched in versions 12.10.9, 13.4.1, and 13.6RC1 of XWiki.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 12.10.912.10.9 -
>= 13.0.0, < 13.4.113.4.1 -
>= 13.5RC1, < 13.6RC113.6RC1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no easy workaround for this vulnerability other than applying the recommended upgrade. It is crucial to ensure that the latest patched version is installed to mitigate the risk of information exposure.
Conclusion
The vulnerability in xwiki-platform-web allows an attacker to determine if a user account exists on the wiki, even if the wiki is closed to guest users. This information exposure can be exploited for targeted attacks and unauthorized access. It is crucial to upgrade to the latest patched versions (12.10.9, 13.4.1, or 13.6RC1) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-web →
FAQ
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply enter your pom.xml file and the playground will analyze it for any open-source vulnerabilities, including CVE-2022-23619.
The vulnerability allows an attacker to determine if a user account exists on the wiki, even if the wiki is closed to guest users. This information can be used for targeted attacks and unauthorized access to user accounts.
There are no known workarounds for this vulnerability other than applying the recommended upgrade to the latest patched version of xwiki-platform-web.
Versions 0 to 13.5 of xwiki-platform-web are affected by this vulnerability.
The CVSS score of this vulnerability is 5.3, indicating a moderate impact.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-web.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
