GHSA-v9j2-q4q5-cxh4
No CSRF protection on the password change form
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-administration-ui | < 12.10.5 | 12.10.5 |
| Maven | org.xwiki.platform:xwiki-platform-administration-ui | >= 13.0, < 13.2 | 13.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
It's possible for forge an URL that, when accessed by an admin, will reset the password of any user in XWiki.
### Patches
The problem has been patched in XWiki 12.10.5, 13.2RC1.
### Workarounds
It's possible to apply the patch manually by modifying the `register_macros.vm` template like in https://github.com/xwiki/xwiki-platform/commit/0a36dbcc5421d450366580217a47cc44d32f7257.
### References
https://jira.xwiki.org/browse/XWIKI-18315
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [security ML](mailto:[email protected])
References
External links from the advisory. They lead to third-party sites.