| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-web | ≥ 13.0.0, < 13.4.1≥ 13.5RC1, < 13.6RC1< 12.10.9 | 13.4.113.6RC112.10.9 |
| xwiki | ≥ 13.0, ≤ 13.4≥ 13.4.2, ≤ 13.6< 12.10.9 | 12.10.9 |
It's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users.
The problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1.
There's no easy workaround other than applying the upgrade.
https://jira.xwiki.org/browse/XWIKI-18787
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free