CVE-2022-23619

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users. This problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1. Users are advised yo update. There are no known workarounds for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200CWE-640

Affected software

No affected versions have been published.

Timeline

Published
Feb 9, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-23627.5The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, whiCVE-2022-236205.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExpoCVE-2022-236214.9XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with CVE-2022-236226.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a croCVE-2022-236238.8Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validaCVE-2022-236248.8Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 aCVE-2022-236256.5Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malformed resource identifierCVE-2022-236268.8m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checkeCVE-2022-236276.8ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ACVE-2022-236285.3OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree (AST) that contains CVE-2022-23634.6A vulnerability, which was classified as problematic, has been found in SourceCodester Simple Parking Management System 1.0. Affected by thiCVE-2022-236307.5Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that veri
CVE-2022-23619: High severity, CVSS 7.5 | Vulnix