Loading...
Skip to main content
GeekWala

CVE-2025-49585 — Vulnerability in...

HIGH

XWiki does not require right warnings for XClass definitions

Published June 13, 2025Updated June 13, 2025Source: osv

Summary

### Impact When an attacker without script or programming right creates an XClass definition in XWiki (requires edit right), and that same document is later edited by a user with script, admin, or programming right, malicious code could be executed with the rights of the editing user without prior warning. In particular, this concerns custom display code, the script of computed properties and queries in database list properties. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. ### Patches This has been patched in XWiki 16.10.2, 16.4.7 and 15.10.16 by adding an analysis for the respective XClass properties. ### Workarounds We're not aware of any real workarounds apart from just being careful with editing documents previously edited by untrusted users as a user with script, admin or programming right.

Advisory Timeline

  • First published June 13, 2025 (486 days ago).
  • Last revised June 13, 2025 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.xwiki.platform:xwiki-platform-security-requiredrights-default to 16.10.2 or later
<!-- Update pom.xml dependency version to 16.10.2 for org.xwiki.platform:xwiki-platform-security-requiredrights-default -->
Maven
Update org.xwiki.platform:xwiki-platform-security-requiredrights-default to 15.10.16 or later
<!-- Update pom.xml dependency version to 15.10.16 for org.xwiki.platform:xwiki-platform-security-requiredrights-default -->
Maven
Update org.xwiki.platform:xwiki-platform-security-requiredrights-default to 16.4.7 or later
<!-- Update pom.xml dependency version to 16.4.7 for org.xwiki.platform:xwiki-platform-security-requiredrights-default -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: maven (1).

PackageEcosystemAffectedFixed In
org.xwiki.platform:xwiki-platform-security-requiredrights-default
maven
All versions16.10.2
org.xwiki.platform:xwiki-platform-security-requiredrights-default
maven
All versions15.10.16
org.xwiki.platform:xwiki-platform-security-requiredrights-default
maven
All versions16.4.7

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.0 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

References

Frequently Asked Questions

What is CVE-2025-49585?
XWiki does not require right warnings for XClass definitions This vulnerability has been assigned a severity rating of HIGH (CVSS score: 9.0/10).
How do I check if my project is affected by CVE-2025-49585?
CVE-2025-49585 affects org.xwiki.platform:xwiki-platform-security-requiredrights-default. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-49585 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.0

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-59w6-r9hm-439h

Related CVEs

  • CVE-2023-46731
    CRITICAL

    XWiki Platform vulnerable to remote code execution through the section parameter in Administration as guest

  • CVE-2023-29514
    CRITICAL

    XWiki vulnerable to Code Injection in template provider administration

  • CVE-2023-36470
    CRITICAL

    XWiki Platform vulnerable to Code Injection in icon themes

  • CVE-2023-45135
    CRITICAL

    XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title

  • CVE-2023-45134
    CRITICAL

    XWiki Platform XSS vulnerability from account in the create page form via template provider

  • CVE-2025-32974
    CRITICAL

    org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type

  • CVE-2023-29207
    HIGH

    Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro

  • CVE-2025-49582
    HIGH

    XWiki's required right warnings for macros are incomplete

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies