PT-2025-11971 · Unknown · Xwiki Platform

Publicado 2025-03-19 · Atualizado 2025-03-19 · CVE-2025-29925

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 15.10.14 XWiki Platform versions prior to 16.4.6 XWiki Platform versions prior to 16.10.0-rc-1

Description The issue affects the XWiki Platform, a generic wiki platform, where protected pages are listed when requesting the REST endpoints "/rest/wikis/[wikiName]/pages" even if the user doesn't have view rights on them. This is particularly true if the entire wiki is protected with "Prevent unregistered user to view pages". The endpoint would still list the pages of the wiki, though only for the main wiki.

Recommendations For versions prior to 15.10.14, update to XWiki Platform version 15.10.14 or later. For versions prior to 16.4.6, update to XWiki Platform version 16.4.6 or later. For versions prior to 16.10.0-rc-1, update to XWiki Platform version 16.10.0-rc-1 or later. As a temporary workaround, consider restricting access to the "/rest/wikis/[wikiName]/pages" endpoint until a patch is applied.

Exploit

Correção

Enumeração de Fraquezas

CWE-402

Identificadores relacionados

BDU:2025-03253

CVE-2025-29925

GHSA-22Q5-9PHM-744V

Produtos afetados

Xwiki Platform

Referências · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29925.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-22639 · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-22630 · Exploit
• https://github.com/xwiki/xwiki-platform · Nota
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-22q5-9phm-744v · Aviso do Fabricante
• https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda4475206 · Correção
• https://github.com/xwiki/xwiki-platform/commit/1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2df · Correção
• https://twitter.com/CveFindCom/status/1902420468797178147 · Publicação no Twitter
• https://t.me/cvedetector/20659 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-29925 · Nota de Segurança
• https://bdu.fstec.ru/vul/2025-03253 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-22q5-9phm-744v · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1902417442946871777 · Publicação no Twitter
• https://safe-surf.ru/specialists/bulletins-nkcki/719274 · Nota de Segurança
• https://t.me/latest_high_impact_cve/2002 · Publicação no Telegram