{"id":"CVE-2021-32732","details":"### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tied to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check it's quite easy to perform a lot of those requests. ### Patches This issue has been patched in XWiki 12.10.5 and 13.2RC1. Two different patches are provided: - a first one to fix the CSRF problem - a more complex one that now relies on sending an email for the Forgot username process. ### Workarounds It's possible to fix the problem without uprading by editing the ForgotUsername page in version below 13.x, to use the following code: https://github.com/xwiki/xwiki-platform/blob/69548c0320cbd772540cf4668743e69f879812cf/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ForgotUsername.xml#L39-L123 In version after 13.x it's also possible to edit manually the forgotusername.vm file, but it's really encouraged to upgrade the version here. ### References * https://jira.xwiki.org/browse/XWIKI-18384 * https://jira.xwiki.org/browse/XWIKI-18408 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki](https://jira.xwiki.org) * Email us at [security ML](mailto:security@xwiki.org)","aliases":["GHSA-vh5c-jqfg-mhrh"],"modified":"2026-08-07T19:48:36.139981Z","published":"2022-02-04T23:15:11.547Z","references":[{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vh5c-jqfg-mhrh"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/69548c0320cbd772540cf4668743e69f879812cf"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/f0440dfcbba705e03f7565cd88893dde57ca3fa8"},{"type":"FIX","url":"https://jira.xwiki.org/browse/XWIKI-18384"},{"type":"FIX","url":"https://jira.xwiki.org/browse/XWIKI-18408"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"0"},{"fixed":"45cb44af6bd0775156a54e0a7e10804eb1689f5b"},{"introduced":"271203deeb757a7c21e3c0623b79e7b3050c2a05"},{"last_affected":"1d2a35bb2773fe8b68f16a65c440beb65b3a49bf"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:13.0:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:13.1:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"12.10.5"},{"introduced":"13.0"},{"last_affected":"13.0"},{"introduced":"13.1-NA"},{"last_affected":"13.1-NA"}]}}],"versions":["13.0","13.1-NA","xwiki-commons-13.1","xwiki-commons-13.1-rc-1","xwiki-commons-12.10.4","xwiki-commons-12.10.3","xwiki-commons-12.10.2","xwiki-commons-12.10.1","xwiki-commons-12.10","xwiki-commons-8.3-milestone-2","xwiki-commons-8.3-milestone-1","xwiki-commons-8.2-milestone-2","xwiki-commons-8.2-milestone-1","xwiki-commons-8.1-milestone-2","xwiki-commons-8.1-milestone-1","xwiki-commons-8.0-milestone-2","xwiki-commons-8.0-milestone-1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32732.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"0"},{"fixed":"648a3522f7213ef0973ffc1ecc19f3237ace437e"},{"introduced":"909c4bf9b308cf9cab52bfed54adccd04bad5803"},{"last_affected":"5e8b9d45b1a37ab1db65cd54e915960db993c6f2"},{"fixed":"69548c0320cbd772540cf4668743e69f879812cf"},{"fixed":"f0440dfcbba705e03f7565cd88893dde57ca3fa8"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:13.0:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:13.1:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"12.10.5"},{"introduced":"13.0"},{"last_affected":"13.0"},{"introduced":"13.1-NA"},{"last_affected":"13.1-NA"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["13.0","13.1-NA","xwiki-platform-13.1","xwiki-platform-13.1-rc-1","xwiki-platform-12.10.4","xwiki-platform-12.10.3","xwiki-platform-12.10.2","xwiki-platform-12.10.1","xwiki-platform-12.10","xwiki-platform-9.9-rc-2","xwiki-platform-8.3-milestone-1","xwiki-platform-8.2-milestone-2","xwiki-platform-8.2-milestone-1","xwiki-platform-8.1-milestone-2","xwiki-platform-8.1-milestone-1","xwiki-platform-8.0-milestone-2","xwiki-platform-8.0-milestone-1","xwiki-platform-7.4-milestone-2","xwiki-platform-7.4-milestone-1","xwiki-platform-7.3-milestone-2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32732.json","vanir_signatures_modified":"2026-08-07T19:48:36Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f0440dfcbba705e03f7565cd88893dde57ca3fa8","target":{"function":"retrieveUsername","file":"xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ForgotUsernameIT.java"},"deprecated":false,"digest":{"function_hash":"321511329396376669312218935850776368126","length":813},"id":"CVE-2021-32732-09f5bee2","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f0440dfcbba705e03f7565cd88893dde57ca3fa8","target":{"file":"xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-pageobjects/src/main/java/org/xwiki/administration/test/po/ForgotUsernameCompletePage.java"},"deprecated":false,"digest":{"line_hashes":["251217306514859619729184700471186833448","199229846389208028956009798926644344764","213871815080359841772049817996547587366","25879533808186726883246047470144874219","62421165840151599138911258022246008760","129694273408657017414493921345509943975","337925841246286738380181249167885145737","17579833428035848139847490700510753504","270426981502098446807195555461356081428","95988757209306918649795552561013156578","197116577369363535185915315576975665036"],"threshold":0.9},"id":"CVE-2021-32732-11403701"},{"source":"https://github.com/xwiki/xwiki-platform/commit/f0440dfcbba705e03f7565cd88893dde57ca3fa8","target":{"file":"xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ForgotUsernameIT.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["212167843153462203918438076222652165542","267833405704134173463587126576270611872","122256918115292340730976151278462974449","253386088988216724541881939744350321869","168528726115801181141102509399456729119","229391438677786712981967939327372002714","213961176082885187054766903672163231412","187913529817686961733626460741875455451","208974072341044210503438707672625612527","191495375154641226014560563177148135448","96747196774251497656021484790891097701","121974007087520156669634355298007897279","311733091909938625917041651662709887816","75532339610968220336271361325290414112","4963411913489212483806052763792358310","27291694393317981520669052303345432939","214383342098226394618605417062846361939","260104887367736406406670934597730531264","281505545462669323924397718938086921186","237035295654585754746416190870919168424","165856873151530329563790312359313904346","318011033276162379696597374478739197271","283648711470615106526451807124100147789","174308907012048630077348165258308703677","260774348310256504927679534918071333626","80363895206049832292556761768904242199","265916118567180192575691118640530936087","46233985816664113650682750722701477674","187012145170103017417385982936492599583","108068986776790943876678393078647506132","161812367812486087699225520824310043052","326766680069370402729348557990253355991","91079803178060339117565205667241073202","273010000897075825769552332254042653601","94568887412941441782799840804991332966"]},"id":"CVE-2021-32732-589deacc","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}]}