PT-2025-50549 · Xwiki · Xwiki

Michitux · Published 2025-07-04 · Updated 2025-12-19 · CVE-2025-66473

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions XWiki versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3, and 17.5.0-rc-1 through 17.6.0

Description The XWiki platform contains a REST API that does not limit the number of items requested in a single request. This can cause performance issues, including slowness and unavailability, particularly when requesting a large number of pages. The /rest/wikis/xwiki/spaces API endpoint is an example, as it returns all spaces (pages) on the wiki by default.

Recommendations Update to XWiki version 17.4.4 or later. Update to XWiki version 16.10.11 or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2025-15981

CVE-2025-66473

GHSA-CC84-Q3V3-MHGF

Affected Products

Xwiki

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66473.json · Exploit
• 🔥 https://jira.xwiki.org/browse/XWIKI-23355 · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cc84-q3v3-mhgf · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/e3c47745195fb445b054537be86f5c01ee69558b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-66473 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66473 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15981 · Security Note
• https://t.me/cveNotify/146357 · Telegram Post
• https://twitter.com/CVEnew/status/1999108906422063447 · Twitter Post
• https://t.me/CVEtracker/39415 · Telegram Post