Skip to content
OpenAdvisories
Medium WID-SEC-2025-0605 3 CVEs

xwiki: Mehrere Schwachstellen

Published Mar 19, 2025 · Updated Mar 19, 2025 · de-DE

Platform: Windows

Summary

Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in xwiki ausnutzen, um Informationen preiszugeben und erhöhte Rechte zu erlangen.

Product

XWiki ist eine Open-Source-Wiki-Software-Plattform, für die Erstellung und Verwaltung von Wikis und Knowledge-Management-Systemen

Vulnerabilities 3

  • High 8.7
    CVE-2025-29924

    XWiki uses the wrong wiki reference in AuthorizationManager

    XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, it's possible for an user to get access to private information through the REST API - but could also be through another API - when a sub wiki is using "Prevent unregistere…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-security-authorization-api Maven
  • High 8.7
    CVE-2025-29925 Scanner template

    XWiki allows unregistered users to access private pages information through REST endpoint

    XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-rest-server Maven
  • High 7.9
    CVE-2025-29926

    The WikiManager REST API allows any user to create wikis

    XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST …

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-wiki-rest-default Maven

Revision history

  1. #1

    Initiale Fassung

References