CVE-2021-32729

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 12.10.4, and 13.0. The script service method used to reset the authentication failures record can be executed by any user with Script rights and does not require Programming rights. An attacher with script rights who is able to reset the authentication failure record might perform a brute force attack, since they would be able to virtually deactivate the mechanism introduced to mitigate those attacks. The problem has been patched in version 12.6.8, 12.10.4 and 13.0. There are no workarounds aside from upgrading.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-693 CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Jul 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-32737.2Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someon CVE-2021-327305.7XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulner CVE-2021-327315.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13 CVE-2021-327326.5### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually ti CVE-2021-327336.1Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versio CVE-2021-327345.3Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text appl CVE-2021-327355.4Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's `ListItem` component (used in the pages and files s CVE-2021-327367.5think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an CVE-2021-327374.8Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for CVE-2021-327386.5js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The `Utils.readChallengeTx` function used in SEP-10 CVE-2021-327398.8Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data CVE-2021-327407.5Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource con