CVE-2025-32974

XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 16.2.0, the required rights analysis doesn't consider TextAreas with default content type. When editing a page, XWiki warns since version 15.9 when there is content on the page like a script macro that would gain more rights due to the editing. This analysis doesn't consider certain kinds of properties, allowing a user to put malicious scripts in there that will be executed after a user with script, admin, or programming rights edited the page. Such a malicious script could impact the confidentiality, integrity and availability of the whole XWiki installation. This issue has been patched in versions 15.10.8 and 16.2.0.

CVSS v3 9.0 CRITICAL

9.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/xwiki/xwiki-platform/commit/153dbfa2ef1a7a0a644fe3f889684c6a8738c5fc	Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mvgm-3rw2-7j4r	Patch Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-22002	Vendor Advisory Issue Tracking
https://jira.xwiki.org/browse/XWIKI-22002	Vendor Advisory Issue Tracking

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:xwiki:xwiki::::::::
	cpe:2.3:a:xwiki:xwiki::::::::

History

13 May 2025, 14:55

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-30 15:16

Updated : 2025-05-13 14:55

NVD link : CVE-2025-32974

Mitre link : CVE-2025-32974

CVE.ORG link : CVE-2025-32974

JSON object : View

Products Affected

xwiki

xwiki

CWE

CWE-116

Improper Encoding or Escaping of Output

CWE-269

Improper Privilege Management

{"id": "CVE-2025-32974", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "published": "2025-04-30T15:16:01.973", "references": [{"url": "https://github.com/xwiki/xwiki-platform/commit/153dbfa2ef1a7a0a644fe3f889684c6a8738c5fc", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mvgm-3rw2-7j4r", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://jira.xwiki.org/browse/XWIKI-22002", "tags": ["Vendor Advisory", "Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://jira.xwiki.org/browse/XWIKI-22002", "tags": ["Vendor Advisory", "Issue Tracking"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-116"}, {"lang": "en", "value": "CWE-269"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 16.2.0, the required rights analysis doesn't consider TextAreas with default content type. When editing a page, XWiki warns since version 15.9 when there is content on the page like a script macro that would gain more rights due to the editing. This analysis doesn't consider certain kinds of properties, allowing a user to put malicious scripts in there that will be executed after a user with script, admin, or programming rights edited the page. Such a malicious script could impact the confidentiality, integrity and availability of the whole XWiki installation. This issue has been patched in versions 15.10.8 and 16.2.0."}, {"lang": "es", "value": "XWiki es una plataforma wiki gen\u00e9rica. En las versiones 15.9-rc-1 y anteriores a la 15.10.8, y 16.0.0-rc-1 y anteriores a la 16.2.0, el an\u00e1lisis de permisos requeridos no considera las \u00e1reas de texto con el tipo de contenido predeterminado. Al editar una p\u00e1gina, XWiki, desde la versi\u00f3n 15.9, advierte cuando hay contenido en la p\u00e1gina, como una macro de script, que podr\u00eda obtener m\u00e1s permisos debido a la edici\u00f3n. Este an\u00e1lisis no considera ciertos tipos de propiedades, lo que permite a un usuario introducir scripts maliciosos que se ejecutar\u00e1n despu\u00e9s de que un usuario con permisos de script, administrador o programaci\u00f3n haya editado la p\u00e1gina. Dicho script malicioso podr\u00eda afectar la confidencialidad, la integridad y la disponibilidad de toda la instalaci\u00f3n de XWiki. Este problema se ha corregido en las versiones 15.10.8 y 16.2.0."}], "lastModified": "2025-05-13T14:55:03.707", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "533AB212-6F11-49BA-A6CA-D051515D0BEA", "versionEndExcluding": "15.10.8", "versionStartIncluding": "15.9"}, {"criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "045A8E1F-5210-4F17-AC25-0317FDD61BDA", "versionEndExcluding": "16.2.0", "versionStartIncluding": "16.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}