1. Home
  2. Vulnerabilities
  3. CVE-2022-23619

CVE-2022-23619

CVSS v3.1 7.5 (High)
75% Progress
CVSS v2.0 5 (Medium)
50% Progress
EPSS 0.15 % (52th)
0.15% Progress
Affected Products 1
Advisories 1
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Tools, Exploits & PoC Graph Web & Social Timeline

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users. This problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1. Users are advised yo update. There are no known workarounds for this issue.

Weaknesses
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-640
Weak Password Recovery Mechanism for Forgotten Password
CVE Status
PUBLISHED
CNA
GitHub, Inc.
Published Date
2022-02-09 21:15:08
(2 years ago)
Updated Date
2022-02-15 18:40:34
(2 years ago)

Affected Products

Xwiki

Configuration #1

    CPE23 From Up To
  Xwiki prior 12.10.9 version cpe:2.3:a:xwiki:xwiki < 12.10.9
  Xwiki from 13.0 version and 13.4 and prior versions cpe:2.3:a:xwiki:xwiki >= 13.0 <= 13.4
  Xwiki from 13.4.2 version and 13.6 and prior versions cpe:2.3:a:xwiki:xwiki >= 13.4.2 <= 13.6