CVE-2021-32620: XWiki users registered with email verification can self re-activate their disabled accounts

May 18, 2021 (updated January 22, 2025)

A user disabled on a wiki using email verification for registration can re-activate himself by using the activation link provided for his registration.

References

github.com/advisories/GHSA-76mp-659p-rw65
github.com/xwiki/xwiki-commons
github.com/xwiki/xwiki-platform/commit/f9a677408ffb06f309be46ef9d8df1915d9099a4
github.com/xwiki/xwiki-platform/security/advisories/GHSA-76mp-659p-rw65
jira.xwiki.org/browse/XWIKI-17942
nvd.nist.gov/vuln/detail/CVE-2021-32620

Code Behaviors & Features

Detect and mitigate CVE-2021-32620 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →