GHSA-r38m-cgpg-qj69 CVE-2025-54124
XWiki leaks password hashes and other accessible password properties
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.48%
- Chance of exploitation in the next 30 days. Higher than 41.48% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
- Fix
- Available
- 2 packages have a fixed version
Description
Impact
Any user with edit right on a page of the wiki can create an XClass with a database list property that references a password property, for example the password hash that is stored for users. When adding an object of that XClass, the content of that password property is displayed. In practice, with a standard rights setup, this means that any user with an account on the wiki can access password hashes of all users, and possibly other password properties (with hashed or plain storage) that are on pages that the user can view.
Patches
This vulnerability has been pached in XWiki 16.4.7, 16.10.5, and 17.2.0 by disallowing the use of password properties in database list properties. Additionally, queries for email properties are disallowed, too, when email obfuscation is enabled.
Workarounds
We're not aware of any workarounds.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.xwiki.platform:xwiki-platform-legacy-oldcore | >= 9.8-rc-1, < 16.4.7 |
16.4.7 |
| org.xwiki.platform:xwiki-platform-legacy-oldcore | >= 16.5.0-rc-1, < 16.10.5 |
16.10.5 |
| org.xwiki.platform:xwiki-platform-legacy-oldcore | >= 17.0.0-rc-1, < 17.2.0-rc-1 |
17.2.0-rc-1 |
| org.xwiki.platform:xwiki-platform-oldcore | >= 9.8-rc-1, < 16.4.7 |
16.4.7 |
| org.xwiki.platform:xwiki-platform-oldcore | >= 16.5.0-rc-1, < 16.10.5 |
16.10.5 |
| org.xwiki.platform:xwiki-platform-oldcore | >= 17.0.0-rc-1, < 17.2.0-rc-1 |
17.2.0-rc-1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.xwiki.platform:xwiki-platform-legacy-oldcore Maven → 16.4.7
- maven
<dependency><groupId>org.xwiki.platform</groupId><artifactId>xwiki-platform-legacy-oldcore</artifactId><version>16.4.7</version></dependency>- gradle
implementation("org.xwiki.platform:xwiki-platform-legacy-oldcore:16.4.7")
org.xwiki.platform:xwiki-platform-oldcore Maven → 16.4.7
- maven
<dependency><groupId>org.xwiki.platform</groupId><artifactId>xwiki-platform-oldcore</artifactId><version>16.4.7</version></dependency>- gradle
implementation("org.xwiki.platform:xwiki-platform-oldcore:16.4.7")
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
How to prevent it
- Requirements: Identify and consult all relevant regulations for personal privacy. An organization may be required to comply with certain federal and state regulations, depending on its location, the type of business it conducts, and the nature of any private data it handles. Regulations may include Safe Harbor Privacy Framework [REF-340], Gramm-Leach Bliley Act (GLBA) [REF-341], Health Insurance Portability and Accountability Act (HIPAA) [REF-342], General Data Protection Regulation (GDPR) [REF-1047], California Consumer Privacy Act (CCPA) [REF-1048], and others.
- Architecture and Design: Carefully evaluate how secure design may interfere with privacy, and vice versa. Security and privacy concerns often seem to compete with each other. From a security perspective, all important operations should be recorded so that any anomalous activity can later be identified. However, when private data is involved, this practice can in fact create risk. Although there are many ways in which private data can be handled unsafely, a common risk stems from misplaced trust. Programmers often trust the operating environment in which a program runs, and therefore believe that it is acceptable store private information on the file system, in the registry, or in other locally-controlled resources. However, even if access to certain resources is restricted, this does not guarantee that the individuals who do have access can be trusted.
- Implementation, Operation: Some tools can automatically analyze documents to redact, strip, or "sanitize" private information, although some human review might be necessary. Tools may vary in terms of which document formats can be processed. When calling an external program to automatically generate or convert documents, invoke the program with any available options that avoid generating sensitive metadata. Some formats have well-defined fields that could contain private data, such as Exchangeable image file format (Exif), which can contain potentially sensitive metadata such as geolocation, date, and time [REF-1515] [REF-1516].
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-qj4x-9g63-25g6 XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+ | High | Also affects org.xwiki.platform:xwiki-platform-oldcore |
| GHSA-mrqg-xmgm-rc5g XWiki's REST APIs can list all pages/spaces, leading to unavailability | High | Also affects org.xwiki.platform:xwiki-platform-legacy-oldcore |
| GHSA-h259-74h5-4rh9 XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API | Critical | Also affects org.xwiki.platform:xwiki-platform-legacy-oldcore |
| GHSA-57q2-6cp4-9mq3 XWiki exposes passwords and emails stored in fields not named password/email in xml.vm | Medium | Also affects org.xwiki.platform:xwiki-platform-legacy-oldcore |
| GHSA-p9qm-p942-q3w5 XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API | Critical | Also affects org.xwiki.platform:xwiki-platform-oldcore |
| GHSA-jp4x-w9cj-97q7 XWiki allows remote code execution through preview of XClass changes in AWM editor | High | Also affects org.xwiki.platform:xwiki-platform-oldcore |
| GHSA-prwh-7838-xf82 XWiki allows SQL injection in query endpoint of REST API with Oracle | Critical | Also affects org.xwiki.platform:xwiki-platform-oldcore |
| GHSA-g9jj-75mx-wjcx org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API | High | Also affects org.xwiki.platform:xwiki-platform-oldcore |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor