CVE-2021-32620: Users registered with email verification can self re-activate their disabled accounts
Impact A user disabled on a wiki using email verification for registration can re-activate himself by using the activation link provided for his registration.
Patches The problem has been patched in the following versions of XWiki: 11.10.13, 12.6.7, 12.10.2, 13.0.
Workarounds It's possible to workaround the issue by resetting the validkey property of the disabled XWiki users. This can be done by editing the user profile with object editor.
References https://jira.xwiki.org/browse/XWIKI-17942
For more information If you have any questions or comments about this advisory: Open an issue in Jira Email us at Security mailing-list
Other sources
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a user disabled on a wiki using email verification for registration canouldre-activate themself by using the activation link provided for his registration. The problem has been patched in the following versions of XWiki: 11.10.13, 12.6.7, 12.10.2, 13.0. It is possible to workaround the issue by resetting the validkey property of the disabled XWiki users. This can be done by editing the user profile with object editor.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32620?
CVE-2021-32620 is classified as a moderate vulnerability due to the potential for unauthorized reactivation of disabled user accounts.
How do I fix CVE-2021-32620?
To fix CVE-2021-32620, upgrade to XWiki versions 11.10.13, 12.6.7, 12.10.2, or 13.0.
What systems are affected by CVE-2021-32620?
CVE-2021-32620 affects XWiki versions from 11.6 to 11.10.12, 12.0 to 12.6.6, and 12.7 to 12.10.1.
What impact does CVE-2021-32620 have on user accounts?
CVE-2021-32620 allows users who have been disabled on a wiki to reactivate themselves using an activation link.
How can I determine if my XWiki installation is vulnerable to CVE-2021-32620?
You can determine if your XWiki installation is vulnerable by checking if it is running any versions prior to the patched versions.