PT-2025-31942 · Xwiki · Xwiki Platform

Michael Hamann · CVE-2025-32430 · Published 2025-06-18 · Updated 2025-08-16

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 4.2-milestone-3 through 16.4.7 XWiki Platform versions 16.5.0-rc-1 through 16.10.5 XWiki Platform versions 17.0.0-rc-1 through 17.2.2

Description The platform contains reflected cross-site scripting (XSS) vulnerabilities in two templates. An attacker can execute malicious JavaScript code in the context of a victim's session by getting the victim to visit a crafted URL. This allows the attacker to perform actions using the victim's permissions. The issue is exploitable through URLs such as /xwiki/bin/view/Main/?xpage=job status json&jobId=asdf&translationPrefix=<img src=1 onerror=alert(document.domain)> and /xwiki/bin/view/Main/?xpage=distribution&extensionId=%3Cimg src=x onerror=alert(document.domain)%3E&extensionVersionConstraint=%3Cimg src=x onerror=alert(document.domain)%3E.

Recommendations XWiki Platform versions prior to 16.4.8 XWiki Platform versions prior to 16.10.6 XWiki Platform versions prior to 17.3.0-rc-1 Manually patch the WAR file with the changes included in the original patch.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-06941

CVE-2025-32430

GHSA-M9X4-W7P9-MXHX

Affected Products

Xwiki Platform

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32430.json · Exploit
• 🔥 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m9x4-w7p9-mxhx · Exploit
• https://github.com/xwiki/xwiki-platform/commit/e5926a938cbecc8b1eaa48053d8d370cff107cb0 · Patch
• https://osv.dev/vulnerability/GHSA-m9x4-w7p9-mxhx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32430 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32430 · Security Note
• https://jira.xwiki.org/browse/XWIKI-23096 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06941 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cveNotify/131013 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1952927484992717179 · Twitter Post
• https://t.me/cveNotify/131157 · Telegram Post
• https://twitter.com/CVEnew/status/1952878140906156101 · Twitter Post
• https://twitter.com/Riya40990628/status/1956817196459401304 · Twitter Post