{"id":"CVE-2022-23619","aliases":["GHSA-35fg-hjcr-j65f"],"url":"https://o3.security/vulnerability/CVE-2022-23619","summary":"Information exposure in xwiki-platform","details":"### Impact\nIt's possible to guess if a user has an account on the wiki by using the \"Forgot your password\" form, even if the wiki is closed to guest users.\n\n### Patches\nThe problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1.\n\n### Workarounds\nThere's no easy workaround other than applying the upgrade.\n\n### References\n\nhttps://jira.xwiki.org/browse/XWIKI-18787\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [JIRA](https://jira.xwiki.org)\n* Email us at [XWiki Security Mailing list](mailto:security@xwiki.org)\n","published":"2022-02-09T21:10:11Z","modified":"2026-08-12T13:00:02.655839Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-web","fixedVersion":"13.6RC1"},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-web","fixedVersion":"13.4.1"},{"ecosystem":"Maven","name":"org.xwiki.platform:xwiki-platform-web","fixedVersion":"12.10.9"}],"fix":{"url":"https://github.com/xwiki/xwiki-platform/commit/d8a3cce48e0ac1a0f4a3cea7a19747382d9c9494","label":"xwiki/xwiki-platform@d8a3cce"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-18787"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23619.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-35fg-hjcr-j65f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23619"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/d8a3cce48e0ac1a0f4a3cea7a19747382d9c9494"},{"type":"PACKAGE","url":"https://github.com/xwiki/xwiki-platform"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T13:00:02.655839Z"}}