PT-2025-11971 · Unknown · Xwiki Platform

Published 2025-03-19 · Updated 2025-03-19 · CVE-2025-29925

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 15.10.14 XWiki Platform versions prior to 16.4.6 XWiki Platform versions prior to 16.10.0-rc-1

Description The issue affects the XWiki Platform, a generic wiki platform, where protected pages are listed when requesting the REST endpoints "/rest/wikis/[wikiName]/pages" even if the user doesn't have view rights on them. This is particularly true if the entire wiki is protected with "Prevent unregistered user to view pages". The endpoint would still list the pages of the wiki, though only for the main wiki.

Recommendations For versions prior to 15.10.14, update to XWiki Platform version 15.10.14 or later. For versions prior to 16.4.6, update to XWiki Platform version 16.4.6 or later. For versions prior to 16.10.0-rc-1, update to XWiki Platform version 16.10.0-rc-1 or later. As a temporary workaround, consider restricting access to the "/rest/wikis/[wikiName]/pages" endpoint until a patch is applied.

Exploit

Fix

Weakness Enumeration

CWE-402

Related Identifiers

BDU:2025-03253

CVE-2025-29925

GHSA-22Q5-9PHM-744V

Affected Products

Xwiki Platform

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29925.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-22639 · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-22630 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-22q5-9phm-744v · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda4475206 · Patch
• https://github.com/xwiki/xwiki-platform/commit/1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2df · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-29925 · Security Note
• https://bdu.fstec.ru/vul/2025-03253 · Security Note
• https://osv.dev/vulnerability/GHSA-22q5-9phm-744v · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/719274 · Security Note
• https://osv.dev/vulnerability/CVE-2025-29925 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://twitter.com/CveFindCom/status/1902420468797178147 · Twitter Post
• https://t.me/cvedetector/20659 · Telegram Post
• https://twitter.com/CVEnew/status/1902417442946871777 · Twitter Post