CVE-2021-32729: xwiki — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2021-32729

CVSS 5.4 · Medium EPSS 0,50%

Kerentanan Protection Mechanism Failure pada xwiki. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 12.10.4, and 13.0. The script service method used to reset the authentication failures record can be executed by any user with Script rights and does not require Programming rights. An attacher with script rights who is able to reset the authentication failure record might perform a brute force attack, since they would be able to virtually deactivate the mechanism introduced to mitigate those attacks. The problem has been patched in version 12.6.8, 12.10.4 and 13.0. There are no workarounds aside from upgrading.

Rincian

Terbit di NVD: 1 Juli 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-693: Protection Mechanism Failure
CWE-732: Incorrect Permission Assignment for Critical Resource
EPSS (30 hari): 0,50% peluang dieksploitasi; lebih tinggi dari 41,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
xwiki	xwiki	Versi 11.6.1 hingga sebelum 12.6.8
xwiki	xwiki	Versi 12.7 hingga sebelum 12.10.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://jira.xwiki.org/browse/XWIKI-18276 issue tracking · advisory vendor
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m738-3rc4-5xv3 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.