PT-2025-32000 · Xwiki · Xwiki Platform

Michael Hamann · Published 2025-01-23 · Updated 2025-08-06 · CVE-2025-54125

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 1.1 through 16.4.6 XWiki Platform versions 16.5.0-rc-1 through 16.10.4 XWiki Platform versions 17.0.0-rc-1 through 17.1.0

Description XWiki Platform Legacy Old Core and XWiki Platform Old Core are affected by an issue where the XML export of a page, accessible to any user with view rights by appending ?xpage=xml to the URL, includes password and email properties stored on a document – even if these properties are not explicitly named password or email.

Recommendations XWiki Platform versions prior to 16.4.7 should be updated. XWiki Platform versions prior to 16.10.5 should be updated. XWiki Platform versions prior to 17.2.0-rc-1 should be updated. If the XML export functionality is not required, delete the templates/xml.vm file from the deployed WAR file.

Exploit

Fix

Weakness Enumeration

CWE-359

Related Identifiers

BDU:2025-09450

CVE-2025-54125

GHSA-57Q2-6CP4-9MQ3

Affected Products

Xwiki Platform

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54125.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-22810 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-57q2-6cp4-9mq3 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59 · Patch
• https://bdu.fstec.ru/vul/2025-09450 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54125 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-57q2-6cp4-9mq3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54125 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://t.me/cveNotify/131015 · Telegram Post
• https://twitter.com/CVEnew/status/1952878138712543285 · Twitter Post