| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.platform:xwiki-platform-administration-ui | ≥ 13.0, < 13.2< 12.10.5 | 13.212.10.5 |
| xwiki | = 13.0= 13.1< 12.10.5 | 12.10.5 |
It's possible for forge an URL that, when accessed by an admin, will reset the password of any user in XWiki.
The problem has been patched in XWiki 12.10.5, 13.2RC1.
It's possible to apply the patch manually by modifying the register_macros.vm template like in https://github.com/xwiki/xwiki-platform/commit/0a36dbcc5421d450366580217a47cc44d32f7257.
https://jira.xwiki.org/browse/XWIKI-18315
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free