CVE-2022-23619: Information exposure in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users. This problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1. Users are advised yo update. There are no known workarounds for this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23619?
CVE-2022-23619 has a moderate severity level due to its potential for user enumeration through the password reset functionality.
How does CVE-2022-23619 affect user privacy?
CVE-2022-23619 allows attackers to infer whether a specific user account exists on a closed wiki, compromising user privacy.
What versions of XWiki are affected by CVE-2022-23619?
CVE-2022-23619 affects XWiki versions below 12.10.9 and versions between 13.0 and 13.6, inclusive.
How can I mitigate CVE-2022-23619?
To mitigate CVE-2022-23619, it is recommended to update XWiki to a version that includes the fix, specifically 12.10.9 or higher.
Is there a recommended action for administrators regarding CVE-2022-23619?
Administrators should immediately upgrade their XWiki installations to a non-vulnerable version to prevent account enumeration attacks.