{"id":"CVE-2021-32731","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13.1RC1 and 13.1, the reset password form reveals the email address of users just by giving their username. The problem has been patched on XWiki 13.2RC1. As a workaround, it is possible to manually modify the `resetpasswordinline.vm` to perform the changes made to mitigate the vulnerability.","aliases":["GHSA-h4m4-pgp4-whgm"],"modified":"2026-08-07T16:58:08.960193Z","published":"2021-07-01T19:15:07.703Z","database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"xwiki:xwiki","cpes":["cpe:2.3:a:xwiki:xwiki:13.1:rc1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"13.1-rc1"},{"last_affected":"13.1-rc1"},{"introduced":"13.1-rc1"},{"last_affected":"13.1-rc1"}]}]},"references":[{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff#diff-14a3132e3986b1f5606dd13d9d8a8bb8634bec9932123c5e49e9604cfd850fc2"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h4m4-pgp4-whgm"},{"type":"FIX","url":"https://jira.xwiki.org/browse/XWIKI-18400"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"1d2a35bb2773fe8b68f16a65c440beb65b3a49bf"},{"last_affected":"1d2a35bb2773fe8b68f16a65c440beb65b3a49bf"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:13.1:-:*:*:*:*:*:*","extracted_events":[{"introduced":"13.1-NA"},{"last_affected":"13.1-NA"}],"source":"CPE_STRING"}}],"versions":["13.1-NA","xwiki-commons-13.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32731.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"5e8b9d45b1a37ab1db65cd54e915960db993c6f2"},{"last_affected":"5e8b9d45b1a37ab1db65cd54e915960db993c6f2"},{"fixed":"0cf716250b3645a5974c80d8336dcdf885749dff"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:13.1:-:*:*:*:*:*:*","extracted_events":[{"introduced":"13.1-NA"},{"last_affected":"13.1-NA"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["13.1-NA","xwiki-platform-13.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32731.json","vanir_signatures_modified":"2026-08-07T16:58:08Z","vanir_signatures":[{"digest":{"length":1584,"function_hash":"253480332439637922064987190340551045073"},"id":"CVE-2021-32731-0ba20792","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff","target":{"file":"xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ResetPasswordIT.java","function":"resetForgottenPassword"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff","target":{"file":"xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ResetPasswordIT.java"},"deprecated":false,"digest":{"line_hashes":["142633199193913322929258289945061914855","53316089628502520382528090005686735928","106336437353265778798287279260731430602","283829312753241704011924731210926140635"],"threshold":0.9},"id":"CVE-2021-32731-dab48973","signature_type":"Line"}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}