Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-32730

CVE-2021-32730: No CSRF protection on the password change form

5.7

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-32730
GHSA ID
GHSA-v9j2-q4q5-cxh4
EPSS Score
0.38982%
CWE
CWE-352
Published
7/2/2021
Updated
2/1/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.xwiki.platform:xwiki-platform-administration-uimaven< 12.10.512.10.5
org.xwiki.platform:xwiki-platform-administration-uimaven>= 13.0, < 13.213.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing CSRF protection in the password change form handler. The commit diff shows:

  1. A CSRF token field was added to the form template
  2. A CSRF check was implemented in the validateFields macro using services.csrf.isTokenValid()
  3. Before the patch, this validation was absent, making the password reset functionality accept unauthenticated requests. The validateFields macro is the core validation routine that processes form submissions, and its lack of CSRF validation directly enabled the exploit scenario described in the advisory.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t It's possi*l* *or *or** *n URL t**t, w**n ****ss** *y *n **min, will r*s*t t** p*sswor* o* *ny us*r in XWiki. ### P*t***s T** pro*l*m **s ***n p*t**** in XWiki **.**.*, **.*R**. ### Work*roun*s It's possi*l* to *pply t** p*t** m*nu*lly *

Reasoning

T** vuln*r**ility st*ms *rom missin* *SR* prot**tion in t** p*sswor* ***n** *orm **n*l*r. T** *ommit *i** s*ows: *. * *SR* tok*n *i*l* w*s ***** to t** *orm t*mpl*t* *. * *SR* ****k w*s impl*m*nt** in t** v*li**t**i*l*s m**ro usin* s*rvi**s.*sr*.isT