Vulnerability · Published Jan 14, 2025 · Assigned by GitHub_M
CVE-2025-23025Privilege escalation (PR) through realtime WYSIWYG editing in XWiki
Critical 9.1
In plain English
A critical-severity missing authorization in xwiki-platform from xwiki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. NOTE: The Realtime WYSIWYG Editor extension was **experimental**, and thus **not recommended**, in the versions affected by this vulnerability. It has become enabled by default, and thus recommended, starting with XWiki 16.9.0. A user with only **edit right** can join a realtime editing session where others, that where already there or that may join later, have **script** or **programming** access rights. This user can then insert **script rendering macros** that are executed for those users in the realtime session that have script or programming rights. The inserted scripts can be used to gain more access rights. This vulnerability has been patched in XWiki 15.10.2, 16.4.1 and 16.6.0-rc-1. Users are advised to upgrade. Users unable to upgrade may either disable the realtime WYSIWYG editing by disabling the ``xwiki-realtime`` CKEditor plugin from the WYSIWYG editor administration section or uninstall the Realtime WYSIWYG Editorextension (org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui | 15.10.12 | GHSA-rmm7-r7wr-xpfg |
| Maven | org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui | 16.4.1 | GHSA-rmm7-r7wr-xpfg |
| Maven | org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui | 16.6.0-rc-1 | GHSA-rmm7-r7wr-xpfg |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-platform | >= 13.9-rc-1, < 15.10.12>= 16.0.0, < 16.4.1>= 16.5.0, < 16.6.0-rc-1 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rmm7-r7wr-xpfg x_refsource_CONFIRM
- https://extensions.xwiki.org/xwiki/bin/view/Extension/CKEditor+Integration#HAdministrationSection x_refsource_MISC
- https://extensions.xwiki.org/xwiki/bin/view/Extension/Realtime%20WYSIWYG%20Editor x_refsource_MISC
- https://jira.xwiki.org/browse/XWIKI-21949 x_refsource_MISC