PT-2025-25436 · Unknown · Xwiki Platform

Michael Hamann · Published 2024-12-17 · Updated 2025-06-13 · CVE-2025-49584

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 10.9 through 16.4.6 XWiki Platform versions 16.5.0-rc-1 through 16.10.2 XWiki Platform versions 17.0.0-rc-1

Description The issue affects XWiki, a generic wiki platform, where an attacker can access the title of every single page whose reference is known through the REST API, as long as an XClass with a page property is accessible. This is the default for an XWiki installation. The impact on confidentiality depends on the strategy for page names, with low impact if page names match the title, but potentially high impact if page names are intentionally obfuscated because the titles are sensitive.

Recommendations For XWiki Platform versions 10.9 through 16.4.6, update to version 16.4.7. For XWiki Platform versions 16.5.0-rc-1 through 16.10.2, update to version 16.10.3. For XWiki Platform versions 17.0.0-rc-1, update to version 17.0.0.

Exploit

Fix

Weakness Enumeration

CWE-201

Related Identifiers

BDU:2025-11355

CVE-2025-49584

GHSA-MVP5-QX9C-C3FV

Affected Products

Xwiki Platform

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49584.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mvp5-qx9c-c3fv · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec · Patch
• https://bdu.fstec.ru/vul/2025-11355 · Security Note
• https://jira.xwiki.org/browse/XWIKI-22736 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49584 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49584 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mvp5-qx9c-c3fv · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/latest_high_impact_cve/2652 · Telegram Post
• https://t.me/cvetracker/26210 · Telegram Post
• https://twitter.com/CveFindCom/status/1933580104782791105 · Twitter Post
• https://twitter.com/CVEnew/status/1933582823702593764 · Twitter Post