PT-2025-4772 · Xwiki · Xwiki Platform

Marius Dumitru Florea

·

Published

2025-01-14

·

Updated

2025-01-18

·

CVE-2025-23025

CVSS v3.1

9.0

Critical

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 15.10.2 XWiki Platform versions prior to 16.4.1 XWiki Platform versions prior to 16.6.0-rc-1
Description A user with only edit right can join a realtime editing session where others have script or programming access rights. This user can then insert script rendering macros that are executed for those users in the realtime session that have script or programming rights. The inserted scripts can be used to gain more access rights.
Recommendations For XWiki Platform versions prior to 15.10.2, upgrade to version 15.10.2 or later. For XWiki Platform versions prior to 16.4.1, upgrade to version 16.4.1 or later. For XWiki Platform versions prior to 16.6.0-rc-1, upgrade to version 16.6.0-rc-1 or later. As a temporary workaround, consider disabling the xwiki-realtime CKEditor plugin from the WYSIWYG editor administration section or uninstall the Realtime WYSIWYG Editor extension (org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui).

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-23025
GHSA-RMM7-R7WR-XPFG

Affected Products

Xwiki Platform