Skip to content
OpenAdvisories
High WID-SEC-2025-0898 5 CVEs

xwiki: Mehrere Schwachstellen

Published Apr 28, 2025 · Updated Apr 28, 2025 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in xwiki ausnutzen, um falsche Informationen darzustellen, einen Denial-of-Service auszulösen, Benutzerrechte zu erlangen oder Cross-Site-Scripting durchzuführen.

Product

XWiki ist eine Open-Source-Wiki-Software-Plattform, für die Erstellung und Verwaltung von Wikis und Knowledge-Management-Systemen

Vulnerabilities 5

  • Critical 9.1
    CVE-2025-32973

    org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right

    XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, when a user with programming rights edits a document in XWiki that was last edited by a us…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-component-wiki Maven
  • Critical 9.1
    CVE-2025-32974

    org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type

    XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 16.2.0, the required rights analysis doesn't consider TextAreas with default content type. When editing a page, XWiki warns since version 15…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-security-requiredrights-default Maven
  • Medium 6.1
    CVE-2025-32970 Scanner template

    org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability

    XWiki is a generic wiki platform. In versions starting from 13.5-rc-1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0, an open redirect vulnerability in the HTML conversion request filter allows attackers to constr…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-wysiwyg-api Maven
  • Low 3.8
    CVE-2025-32971

    XWiki Solr script service doesn't take dropped programming right into account

    XWiki is a generic wiki platform. In versions starting from 4.5.1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the Solr script service doesn't take dropped programming rights into account. The Solr script …

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-search-solr-api Maven
  • Low 2.7
    CVE-2025-32972

    The lesscss script service allows cache clearing without programming right

    XWiki is a generic wiki platform. In versions starting from 6.1-milestone-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the script API of the LESS compiler in XWiki is incorrectly checking for rights when…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-lesscss-script Maven

Revision history

  1. #1

    Initiale Fassung

References