CVE-2025-46557

XWiki is a generic wiki platform. In versions starting from 15.3-rc-1 to before 15.10.14, from 16.0.0-rc-1 to before 16.4.6, and from 16.5.0-rc-1 to before 16.10.0-rc-1, a user who can access pages located in the XWiki space (by default, anyone) can access the page XWiki.Authentication.Administration and (unless an authenticator is set in xwiki.cfg) switch to another installed authenticator. Note that, by default, there is only one authenticator available (Standard XWiki Authenticator). So, if no authenticator extension was installed, it's not really possible to do anything for an attacker. Also, in most cases, if an SSO authenticator is installed and utilized (like OIDC or LDAP for example), the worst an attacker can do is break authentication by switching back to the standard authenticator (that's because it's impossible to login to a user which does not have a stored password, and that's usually what SSO authenticator produce). This issue has been patched in versions 15.10.14, 16.4.6, and 16.10.0-rc-1.

CVSS

No CVSS.

References

Link	Resource
https://github.com/xwiki/xwiki-platform/commit/5efc31cea1501c9a5cb593566fea8b558ff32a2a
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f9c6-2f9p-82jj
https://jira.xwiki.org/browse/XWIKI-22604

Configurations

No configuration.

History

02 May 2025, 13:53

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-30 19:15

Updated : 2025-05-02 13:53

NVD link : CVE-2025-46557

Mitre link : CVE-2025-46557

CVE.ORG link : CVE-2025-46557

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-46557", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-04-30T19:15:55.783", "references": [{"url": "https://github.com/xwiki/xwiki-platform/commit/5efc31cea1501c9a5cb593566fea8b558ff32a2a", "source": "security-advisories@github.com"}, {"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f9c6-2f9p-82jj", "source": "security-advisories@github.com"}, {"url": "https://jira.xwiki.org/browse/XWIKI-22604", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "XWiki is a generic wiki platform. In versions starting from 15.3-rc-1 to before 15.10.14, from 16.0.0-rc-1 to before 16.4.6, and from 16.5.0-rc-1 to before 16.10.0-rc-1, a user who can access pages located in the XWiki space (by default, anyone) can access the page XWiki.Authentication.Administration and (unless an authenticator is set in xwiki.cfg) switch to another installed authenticator. Note that, by default, there is only one authenticator available (Standard XWiki Authenticator). So, if no authenticator extension was installed, it's not really possible to do anything for an attacker. Also, in most cases, if an SSO authenticator is installed and utilized (like OIDC or LDAP for example), the worst an attacker can do is break authentication by switching back to the standard authenticator (that's because it's impossible to login to a user which does not have a stored password, and that's usually what SSO authenticator produce). This issue has been patched in versions 15.10.14, 16.4.6, and 16.10.0-rc-1."}, {"lang": "es", "value": "XWiki es una plataforma wiki gen\u00e9rica. En las versiones 15.3-rc-1 y anteriores a la 15.10.14, 16.0.0-rc-1 y anteriores a la 16.4.6, y 16.5.0-rc-1 y anteriores a la 16.10.0-rc-1, un usuario con acceso a p\u00e1ginas del espacio XWiki (por defecto, cualquiera) puede acceder a la p\u00e1gina XWiki.Authentication.Administration y (a menos que se configure un autenticador en xwiki.cfg) cambiar a otro autenticador instalado. Tenga en cuenta que, por defecto, solo hay un autenticador disponible (el autenticador est\u00e1ndar de XWiki). Por lo tanto, si no se instal\u00f3 ninguna extensi\u00f3n de autenticador, no es posible hacer nada contra un atacante. Adem\u00e1s, en la mayor\u00eda de los casos, si se instala y utiliza un autenticador SSO (como OIDC o LDAP, por ejemplo), lo peor que puede hacer un atacante es interrumpir la autenticaci\u00f3n volviendo al autenticador est\u00e1ndar (esto se debe a que es imposible iniciar sesi\u00f3n con un usuario sin una contrase\u00f1a guardada, y eso es lo que suele producir el autenticador SSO). Este problema se ha corregido en las versiones 15.10.14, 16.4.6 y 16.10.0-rc-1."}], "lastModified": "2025-05-02T13:53:40.163", "sourceIdentifier": "security-advisories@github.com"}