Skip to content
OpenAdvisories
Medium WID-SEC-2025-2629 2 CVEs

xwiki (AdminTools und Pro Macros): Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Published Nov 18, 2025 · Updated Nov 18, 2025 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in xwiki ausnutzen, um Informationen offenzulegen.

Product

XWiki ist eine Open-Source-Wiki-Software-Plattform, für die Erstellung und Verwaltung von Wikis und Knowledge-Management-Systemen

Vulnerabilities 2

  • Medium 6.8
    CVE-2025-65089

    XWiki view file macro: User can view content of office file without view rights on the attachment

    XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issu…

    xwikisas xwiki-pro-macros com.xwiki.pro:xwiki-pro-macros-ui Maven
  • Medium 5.3
    CVE-2025-54990

    XWiki AdminTools application doesn't set permissions on the AdminTools space

    XWiki AdminTools integrates administrative tools for managing a running XWiki instance. Prior to version 1.1, users without admin rights have access to AdminTools.SpammedPages. View rights are not restricted only to admin users for AdminTools.SpammedPages. Wh…

    xwikisas application-admintools com.xwiki.admintools:application-admintools Maven

Revision history

  1. #1

    Initiale Fassung

References