Vulnerability · Published Apr 30, 2025 · Assigned by GitHub_M
CVE-2025-32970org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability
Medium 6.1
In plain English
A medium-severity open redirect in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
XWiki is a generic wiki platform. In versions starting from 13.5-rc-1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0, an open redirect vulnerability in the HTML conversion request filter allows attackers to construct URLs on an XWiki instance that redirects to any URL. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.xwiki.platform:xwiki-platform-wysiwyg-api | 15.10.13 | GHSA-pjhg-9wr9-rj96 |
| Maven | org.xwiki.platform:xwiki-platform-wysiwyg-api | 16.4.4 | GHSA-pjhg-9wr9-rj96 |
| Maven | org.xwiki.platform:xwiki-platform-wysiwyg-api | 16.8.0 | GHSA-pjhg-9wr9-rj96 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| xwiki | xwiki-platform | >= 13.5-rc-1, < 15.10.13>= 16.0.0-rc-1, < 16.4.4>= 16.5.0-rc-1, < 16.8.0 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pjhg-9wr9-rj96 x_refsource_CONFIRM
- https://github.com/xwiki/xwiki-platform/commit/6dab7909f45deb00efd36a0cd47788e95ad64802 x_refsource_MISC
- https://jira.xwiki.org/browse/XWIKI-22487 x_refsource_MISC