CVE-2025-58049

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies unencrypted in job statuses. XWiki shouldn't store passwords in plain text, and it shouldn't be possible to gain access to plain text passwords by gaining access to, e.g., a backup of the data directory. This vulnerability has been patched in XWiki 16.4.8, 16.10.7, and 17.4.0-rc-1.

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/xwiki/xwiki-platform/commit/60982ad0057b1701ed8297f28cad35d170686539	Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9m7c-m33f-3429	Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-23151	Exploit Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:xwiki:xwiki::::::::
	cpe:2.3:a:xwiki:xwiki::::::::
	cpe:2.3:a:xwiki:xwiki::::::::

History

02 Sep 2025, 17:34

Type	Values Removed	Values Added
CPE		cpe:2.3:a:xwiki:xwiki::::::::
References	~~() https://github.com/xwiki/xwiki-platform/commit/60982ad0057b1701ed8297f28cad35d170686539 -~~	() https://github.com/xwiki/xwiki-platform/commit/60982ad0057b1701ed8297f28cad35d170686539 - Patch
References	~~() https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9m7c-m33f-3429 -~~	() https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9m7c-m33f-3429 - Vendor Advisory
References	~~() https://jira.xwiki.org/browse/XWIKI-23151 -~~	() https://jira.xwiki.org/browse/XWIKI-23151 - Exploit, Issue Tracking, Vendor Advisory
First Time		Xwiki xwiki Xwiki

28 Aug 2025, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-28 18:15

Updated : 2025-09-02 17:34

NVD link : CVE-2025-58049

Mitre link : CVE-2025-58049

CVE.ORG link : CVE-2025-58049

JSON object : View

Products Affected

xwiki

xwiki

CWE

CWE-212

Improper Removal of Sensitive Information Before Storage or Transfer

CWE-257

Storing Passwords in a Recoverable Format

{"id": "CVE-2025-58049", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-08-28T18:15:33.657", "references": [{"url": "https://github.com/xwiki/xwiki-platform/commit/60982ad0057b1701ed8297f28cad35d170686539", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9m7c-m33f-3429", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://jira.xwiki.org/browse/XWIKI-23151", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-212"}, {"lang": "en", "value": "CWE-257"}]}], "descriptions": [{"lang": "en", "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies unencrypted in job statuses. XWiki shouldn't store passwords in plain text, and it shouldn't be possible to gain access to plain text passwords by gaining access to, e.g., a backup of the data directory. This vulnerability has been patched in XWiki 16.4.8, 16.10.7, and 17.4.0-rc-1."}], "lastModified": "2025-09-02T17:34:25.467", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "532F5636-F862-48B4-BA5F-F0BF391352AD", "versionEndExcluding": "16.4.8", "versionStartIncluding": "14.4.2"}, {"criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DEAB833-8F14-42C3-9716-BFF595E82F52", "versionEndExcluding": "16.10.7", "versionStartIncluding": "16.5.0"}, {"criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1B3E17E-EB52-4E36-9D50-4045914A05F9", "versionEndIncluding": "17.3.0", "versionStartIncluding": "17.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}