CVE-2021-32729

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 12.10.4, and 13.0. The script service method used to reset the authentication failures record can be executed by any user with Script rights and does not require Programming rights. An attacher with script rights who is able to reset the authentication failure record might perform a brute force attack, since they would be able to virtually deactivate the mechanism introduced to mitigate those attacks. The problem has been patched in version 12.6.8, 12.10.4 and 13.0. There are no workarounds aside from upgrading.

• CWE-693
• CWE-732

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m738-3rc4-5xv3Third Party Advisory
• https://jira.xwiki.org/browse/XWIKI-18276Issue Tracking, Vendor Advisory
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m738-3rc4-5xv3Third Party Advisory
• https://jira.xwiki.org/browse/XWIKI-18276Issue Tracking, Vendor Advisory

Published

Jul 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32723Prism is a syntax highlighting library. Some languages befor…6.5
• CVE-2021-32724check-spelling is a github action which provides CI spell ch…9.9
• CVE-2021-32725Nextcloud Server is a Nextcloud package that handles data st…5.3
• CVE-2021-32726Nextcloud Server is a Nextcloud package that handles data st…9.8
• CVE-2021-32727Nextcloud Android Client is the Android client for Nextcloud…7.5
• CVE-2021-32728The Nextcloud Desktop Client is a tool to synchronize files …6.5
• CVE-2021-3273Nagios XI below 5.7 is affected by code injection in the /na…7.2
• CVE-2021-32730XWiki Platform is a generic wiki platform offering runtime s…5.7
• CVE-2021-32731XWiki Platform is a generic wiki platform offering runtime s…5.3
• CVE-2021-32732### Impact It's possible to know if a user has or not an acc…6.5
• CVE-2021-32733Nextcloud Text is a collaborative document editing applicati…6.1
• CVE-2021-32734Nextcloud Server is a Nextcloud package that handles data st…5.3