CVE-2021-32731: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13.1RC1 and 13.1, the reset password form reveals the email address of users just by giving their username. The problem has been patched on XWiki 13.2RC1. As a workaround, it is possible to manually modify the `resetpasswordinline.vm` to perform the changes made to mitigate the vulnerability.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2021-07-01T19:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Other
Files changed: xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ResetPasswordIT.java, xwiki-platform-core/xwiki-platform-web/src/main/webapp/templates/resetpasswordinline.vm
Commit date: 2021-03-03 18:29:23 +0100
Commit message: XWIKI-18400: Wrong message after reset password

Diff: diff --git a/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ResetPasswordIT.java b/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ResetPasswordIT.java
index 46e0440e7ee..e3f095fa50d 100644
--- a/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ResetPasswordIT.java
+++ b/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-test/xwiki-platform-administration-test-docker/src/test/it/org/xwiki/administration/test/ui/ResetPasswordIT.java
@@ -136,11 +136,15 @@ public void resetForgottenPassword(TestUtils setup) throws Exception
         setup.forceGuestUser();
 
         // Actually reset the user's password
         resetPasswordPage = ResetPasswordPage.gotoPage();
         resetPasswordPage.setUserName(userName);
-        resetPasswordPage.clickResetPassword();
+        ResetPasswordPage newResetPasswordPage = resetPasswordPage.clickResetPassword();
+        assertTrue(newResetPasswordPage.getMessage().contains("An e-mail was sent"),
+            "Actual message: " + newResetPasswordPage.getMessage());
+        assertFalse(newResetPasswordPage.getMessage().contains("foo@bar.com"),
+            "Actual message: " + newResetPasswordPage.getMessage());
 
         // Check the result
         assertTrue(resetPasswordPage.isResetPasswordSent());
         // Check the emails received by the user
         assertTrue(this.mail.waitForIncomingEmail(1));
diff --git a/xwiki-platform-core/xwiki-platform-web/src/main/webapp/templates/resetpasswordinline.vm b/xwiki-platform-core/xwiki-platform-web/src/main/webapp/templates/resetpasswordinline.vm
index 36d977abcf6..c86a6dd840f 100644
--- a/xwiki-platform-core/xwiki-platform-web/src/main/webapp/templates/resetpasswordinline.vm
+++ b/xwiki-platform-core/xwiki-platform-web/src/main/webapp/templates/resetpasswordinline.vm
@@ -82,11 +82,11 @@ $services.localization.render('xe.admin.passwordReset.instructions')
         #if ("$!exception" != '')
             #resetPasswordBoxStart("warning")
             #displayResetPasswordException()
         #else
             #resetPasswordBoxStart("default")
-            $services.localization.render('xe.admin.passwordReset.emailSent', ["$email"])
+            $services.localization.render('xe.admin.passwordReset.emailSent', ["$services.mail.general.obfuscate($email)"])
         #end
     #end
   <div>
       <a href="$services.security.authentication.getAuthenticationURL('reset', $NULL)">$services.localization.render('xe.admin.passwordReset.error.retry')</a> |
       <a href="$xwiki.getURL('XWiki.ForgotUsername')">$services.localization.render('xe.admin.passwordReset.error.recoverUsername')</a> |

Vulnerable code:         resetPasswordPage.clickResetPassword();
            $services.localization.render('xe.admin.passwordReset.emailSent', ["$email"])
Fixed code:         ResetPasswordPage newResetPasswordPage = resetPasswordPage.clickResetPassword();
        assertTrue(newResetPasswordPage.getMessage().contains("An e-mail was sent"),
            "Actual message: " + newResetPasswordPage.getMessage());
        assertFalse(newResetPasswordPage.getMessage().contains("foo@bar.com"),
            "Actual message: " + newResetPasswordPage.getMessage());
            $services.localization.render('xe.admin.passwordReset.emailSent', ["$services.mail.general.obfuscate($email)"])