Loading...
Skip to main content
GeekWala

CVE-2025-29926 — Vulnerability in...

HIGH

The WikiManager REST API allows any user to create wikis

Published March 19, 2025Updated March 19, 2025Source: osv

Summary

### Impact Any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager. ### Patches The problem has been patched in versions 15.10.15, 16.4.6 and 16.10.0 of the REST module. ### Workarounds There's no workaround other than upgrading the dependency. ### References * JIRA ticket: https://jira.xwiki.org/browse/XWIKI-22490 * Commit of the fix: https://github.com/xwiki/xwiki-platform/commit/82aa670106c7f5e6238ca6ed59a52d1800e05b99 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org) ### Attribution You can specify here who reported the issue.

Advisory Timeline

  • First published March 19, 2025 (572 days ago).
  • Last revised March 19, 2025 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.xwiki.platform:xwiki-platform-wiki-rest-default to 16.10.0 or later
<!-- Update pom.xml dependency version to 16.10.0 for org.xwiki.platform:xwiki-platform-wiki-rest-default -->
Maven
Update org.xwiki.platform:xwiki-platform-wiki-rest-default to 16.4.6 or later
<!-- Update pom.xml dependency version to 16.4.6 for org.xwiki.platform:xwiki-platform-wiki-rest-default -->
Maven
Update org.xwiki.platform:xwiki-platform-wiki-rest-default to 15.10.15 or later
<!-- Update pom.xml dependency version to 15.10.15 for org.xwiki.platform:xwiki-platform-wiki-rest-default -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: maven (1).

PackageEcosystemAffectedFixed In
org.xwiki.platform:xwiki-platform-wiki-rest-default
maven
All versions16.10.0
org.xwiki.platform:xwiki-platform-wiki-rest-default
maven
All versions16.4.6
org.xwiki.platform:xwiki-platform-wiki-rest-default
maven
All versions15.10.15

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-285
    Improper AuthorizationMITRE
  • CWE-862
    Missing AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 10.0 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H

References

Frequently Asked Questions

What is CVE-2025-29926?
The WikiManager REST API allows any user to create wikis This vulnerability has been assigned a severity rating of HIGH (CVSS score: 10.0/10).
How do I check if my project is affected by CVE-2025-29926?
CVE-2025-29926 affects org.xwiki.platform:xwiki-platform-wiki-rest-default. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-29926 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
10.0

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-gfp2-6qhm-7x43

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies