XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a user disabled on a wiki using email verification for registration canouldre-activate themself by using the activation link provided for his registration. The problem has been patched in the following versions of XWiki: 11.10.13, 12.6.7, 12.10.2, 13.0. It is possible to workaround the issue by resetting the `validkey` property of the disabled XWiki users. This can be done by editing the user profile with object editor.
References
Link | Resource |
---|---|
https://github.com/xwiki/xwiki-platform/commit/f9a677408ffb06f309be46ef9d8df1915d9099a4 | Patch Third Party Advisory |
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-76mp-659p-rw65 | Third Party Advisory |
https://jira.xwiki.org/browse/XWIKI-17942 | Permissions Required Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2021-05-28T21:05:15
Updated: 2021-06-07T11:11:22
Reserved: 2021-05-12T00:00:00
Link: CVE-2021-32620
JSON object: View
NVD Information
Status : Analyzed
Published: 2021-05-28T21:15:08.937
Modified: 2022-08-05T12:37:38.873
Link: CVE-2021-32620
JSON object: View
Redhat Information
No data.