PT-2025-17644 · Xwiki · Xwiki

Madprogrammer · Published 2024-12-06 · Updated 2025-04-30 · CVE-2025-32969

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XWiki versions 1.8 through 15.10.15 XWiki versions 16.4.0 through 16.4.5 XWiki versions 16.10.0 through 16.10.0

Description XWiki is a generic wiki platform. In the affected versions, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend. This can occur even when the "Prevent unregistered users from viewing pages, regardless of the page rights" and "Prevent unregistered users from editing pages, regardless of the page rights" options are enabled. Depending on the used database backend, the attacker may be able to obtain confidential information such as password hashes from the database and execute UPDATE/INSERT/DELETE queries.

Recommendations For XWiki versions 1.8 through 15.10.15, upgrade to version 15.10.16. For XWiki versions 16.4.0 through 16.4.5, upgrade to version 16.4.6. For XWiki versions 16.10.0 through 16.10.0, upgrade to version 16.10.1.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-13120

CVE-2025-32969

GHSA-F69V-XRJ8-RHXF

Affected Products

Xwiki

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32969.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f69v-xrj8-rhxf · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113 · Patch
• https://jira.xwiki.org/browse/XWIKI-22691 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32969 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13120 · Security Note
• https://osv.dev/vulnerability/GHSA-f69v-xrj8-rhxf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32969 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://twitter.com/CCBalert/status/1915436563175031052 · Twitter Post
• https://t.me/latest_high_impact_cve/2188 · Telegram Post
• https://twitter.com/CveFindCom/status/1915073879413756412 · Twitter Post
• https://twitter.com/SecAideInfo/status/1916073058579714329 · Twitter Post
• https://twitter.com/dailycve/status/1917633750164193400 · Twitter Post
• https://twitter.com/cybercronai/status/1915421350786748699 · Twitter Post