Log in Start free

Vulnerability · Published Apr 30, 2025 · Assigned by GitHub_M

CVE-2025-46554XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API

Medium 5.3

In plain English

A medium-severity missing authorization in xwiki-platform from xwiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.1%top 35.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei

Official description

XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. There is no filtering for the results depending on current user rights, meaning an unauthenticated user could exploit this even in a private wiki. This issue has been patched in versions 14.10.22, 15.10.12, 16.4.3, and 16.7.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.xwiki.platform:xwiki-platform-rest-server14.10.22GHSA-r5cr-xm48-97xp
Mavenorg.xwiki.platform:xwiki-platform-rest-server15.10.12GHSA-r5cr-xm48-97xp
Mavenorg.xwiki.platform:xwiki-platform-rest-server16.4.3GHSA-r5cr-xm48-97xp
Mavenorg.xwiki.platform:xwiki-platform-rest-server16.7.0GHSA-r5cr-xm48-97xp

Affected products (as reported)

VendorProductVersions
xwiki xwiki-platform >= 1.8.1, < 14.10.22>= 15.0-rc-1, < 15.10.12>= 16.0.0-rc-1, < 16.4.3>= 16.5.0-rc-1, < 16.7.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References