PT-2025-22410 · Xwiki · Xwiki

Michael Hamann · Published 2025-02-06 · Updated 2025-05-21 · CVE-2025-48063

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWiki versions 16.10.0 through 16.10.3

Description The issue is related to a bug in the implementation of required rights in XWiki, allowing any user with edit right on a document to set programming right as required right. This could lead to remote code execution if a user with programming right edits the document. The impact is considered low, as the vulnerability provides no additional attack surface unless all documents in the wiki enforce required rights. However, gaining programming right could have a high impact.

Recommendations For XWiki versions 16.10.0 through 16.10.3, upgrade to XWiki 16.10.4 or 17.1.0RC1 to resolve the issue. As a temporary workaround, consider restricting access to documents with required rights enforced, to minimize the risk of exploitation.

Exploit

Fix

RCE

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2025-06358

CVE-2025-48063

GHSA-RHFV-688C-P6HP

Affected Products

Xwiki

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48063.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-22859 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rhfv-688c-p6hp · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/2557813aef3b863988d6cca58de996e207086898 · Patch
• https://bdu.fstec.ru/vul/2025-06358 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-48063 · Security Note
• https://osv.dev/vulnerability/GHSA-rhfv-688c-p6hp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48063 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://twitter.com/CVEnew/status/1925247831461220569 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1925314602146955708 · Twitter Post