PT-2025-11970 · Unknown · Xwiki Platform

Published 2025-03-19 · Updated 2025-04-30 · CVE-2025-29924

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 15.10.14 XWiki Platform versions prior to 16.4.6 XWiki Platform versions prior to 16.10.0-rc-1

Description The issue allows an user to access private information through the REST API when a sub wiki is using specific right options such as Prevent unregistered users to view pages or Prevent unregistered users to edit pages. This issue only affects subwikis. It's possible to detect the vulnerability by enabling Prevent unregistered users to view pages and then trying to access a page through the REST API without using any credentials.

Recommendations For versions prior to 15.10.14, update to version 15.10.14 or later. For versions prior to 16.4.6, update to version 16.4.6 or later. For versions prior to 16.10.0-rc-1, update to version 16.10.0-rc-1 or later. As a temporary workaround, consider disabling the Prevent unregistered users to view pages and Prevent unregistered users to edit pages options until a patch is applied. Restrict access to the REST API to minimize the risk of exploitation.

Exploit

Fix

Incorrect Authorization

Improper Privilege Management

Weakness Enumeration

CWE-863

CWE-269

Related Identifiers

BDU:2025-03252

CVE-2025-29924

GHSA-GQ32-758C-3WM3

Affected Products

Xwiki Platform

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29924.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-22640 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gq32-758c-3wm3 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/5f98bde87288326cf5787604e2bb87836875ed0e · Patch
• https://safe-surf.ru/specialists/bulletins-nkcki/719275 · Security Note
• https://bdu.fstec.ru/vul/2025-03252 · Security Note
• https://osv.dev/vulnerability/CVE-2025-29924 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29924 · Security Note
• https://osv.dev/vulnerability/GHSA-gq32-758c-3wm3 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvedetector/20660 · Telegram Post
• https://twitter.com/CVEnew/status/1902417443861200977 · Twitter Post
• https://twitter.com/CveFindCom/status/1902420533066789379 · Twitter Post
• https://twitter.com/dailycve/status/1917632938490958162 · Twitter Post
• https://t.me/cvetracker/19465 · Telegram Post