PT-2025-18291 · Xwiki · Xwiki

Published 2024-09-05 · Updated 2025-04-30 · CVE-2025-32970

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions XWiki versions 13.5-rc-1 through 15.10.12 XWiki versions 16.0.0-rc-1 through 16.4.3 XWiki versions 16.5.0-rc-1 through 16.7.x

Description The issue is related to an open redirect vulnerability in the HTML conversion request filter. This allows attackers to construct URLs on an XWiki instance that redirect to any URL.

Recommendations For versions 13.5-rc-1 through 15.10.12, update to version 15.10.13 or later. For versions 16.0.0-rc-1 through 16.4.3, update to version 16.4.4 or later. For versions 16.5.0-rc-1 through 16.7.x, update to version 16.8.0 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2025-05357

CVE-2025-32970

GHSA-PJHG-9WR9-RJ96

Affected Products

Xwiki

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32970.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-22487 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pjhg-9wr9-rj96 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/6dab7909f45deb00efd36a0cd47788e95ad64802 · Patch
• https://bdu.fstec.ru/vul/2025-05357 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-32970 · Security Note
• https://osv.dev/vulnerability/GHSA-pjhg-9wr9-rj96 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32970 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cvedetector/24112 · Telegram Post
• https://t.me/cvetracker/22724 · Telegram Post
• https://twitter.com/CVEnew/status/1917598963819246030 · Twitter Post