xwiki: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 8

• High 8.7
  CVE-2025-49581

  XWiki allows remote code execution through default value of wiki macro wiki-type parameters

  XWiki is a generic wiki platform. Any user with edit right on a page (could be the user's profile) can execute code (Groovy, Python, Velocity) with programming right by defining a wiki macro. This allows full access to the whole XWiki installation. The main p…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-rendering-wikimacro-store Maven
  Jun 13, 2025
• High 8.7
  CVE-2025-49584

  XWiki makes title of inaccessible pages available through the class property values REST API

  XWiki is a generic wiki platform. In XWiki Platform versions 10.9 through 16.4.6, 16.5.0-rc-1 through 16.10.2, and 17.0.0-rc-1, the title of every single page whose reference is known can be accessed through the REST API as long as an XClass with a page prope…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-rest-server Maven
  Jun 13, 2025
• High 8.7
  CVE-2025-49586

  XWiki allows remote code execution through preview of XClass changes in AWM editor

  XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki) can obtain programming right/perform remote code execution by editing the application. This vulnera…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-oldcore Maven
  Jun 13, 2025
• High 8.6
  CVE-2025-49582

  XWiki's required right warnings for macros are incomplete

  XWiki is a generic wiki platform. When editing content that contains "dangerous" macros like malicious script macros that were authored by a user with fewer rights, XWiki warns about the execution of these macros since XWiki 15.9RC1. These required rights ana…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-security-requiredrights-default org.xwiki.platform:xwiki-platform-rendering-macro-context Maven
  Jun 13, 2025
• High 8.6
  CVE-2025-49585

  XWiki does not require right warnings for XClass definitions

  XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or programming right creates an XClass definition in XWiki (requires edit right), and that same documen…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-security-requiredrights-default Maven
  Jun 13, 2025
• High 8.5
  CVE-2025-49580

  XWiki allows privilege escalation through link refactoring

  XWiki is a generic wiki platform. From 8.2 and 7.4.5 until 17.1.0-rc-1, 16.10.4, and 16.4.7, pages can gain script or programming rights when they contain a link and the target of the link is renamed or moved. This might lead to execution of scripts contained…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-refactoring-default Maven
  Jun 13, 2025
• Medium 6.4
  CVE-2025-49587

  XWiki does not require right warnings for notification displayer objects

  XWiki is an open-source wiki software platform. When a user without script right creates a document with an XWiki.Notifications.Code.NotificationDisplayerClass object, and later an admin edits and saves that document, the possibly malicious content of that ob…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-notifications-notifiers-default Maven
  Jun 13, 2025
• Medium 5.1
  CVE-2025-49583

  XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right

  XWiki is a generic wiki platform. When a user without script right creates a document with an `XWiki.Notifications.Code.NotificationEmailRendererClass` object, and later an admin edits and saves that document, the email templates in this object will be used f…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-notifications-notifiers-default Maven
  Jun 13, 2025

Revision history

1. 2025-06-12 #1

   Initiale Fassung

References

• GitHub Security Advisory GHSA-jm43-hrq7-r7w6 vom 2025-06-12
  https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jm43-hrq7-r7w6
• GitHub Security Advisory GHSA-9875-cw22-f7cx vom 2025-06-12
  https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9875-cw22-f7cx
• GitHub Security Advisory GHSA-c32m-27pj-4xcj vom 2025-06-12
  https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c32m-27pj-4xcj
• GitHub Security Advisory GHSA-ff6v-w58f-v97w vom 2025-06-12
  https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-ff6v-w58f-v97w
• GitHub Security Advisory GHSA-mvp5-qx9c-c3fv vom 2025-06-12
  https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mvp5-qx9c-c3fv
• GitHub Security Advisory GHSA-59w6-r9hm-439h vom 2025-06-12
  https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-59w6-r9hm-439h
• GitHub Security Advisory GHSA-jp4x-w9cj-97q7 vom 2025-06-12
  https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp4x-w9cj-97q7
• GitHub Security Advisory GHSA-j7p2-87q3-44w7 vom 2025-06-12
  https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-j7p2-87q3-44w7