CVE-2025-29925

low-risk
Published 2025-03-19

XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent unregistered user to view pages": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.

Do I need to act?

-
0.39% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Xwiki

References (7)

Patch https://github.com/xwiki/xwiki-platform/commit/1fb12d2780f37b34a1b4dfdf8457d97ce...
Patch https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda...
Vendor Advisory https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-22q5-9phm-744v
Exploit https://jira.xwiki.org/browse/XWIKI-22630
Issue Tracking https://jira.xwiki.org/browse/XWIKI-22639
Exploit https://jira.xwiki.org/browse/XWIKI-22630
Issue Tracking https://jira.xwiki.org/browse/XWIKI-22639
27
/ 100
low-risk
Severity 21/34 · High
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal