XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager. The problem has been patched in versions 15.10.15, 16.4.6 and 16.10.0 of the REST module.
References
| Link | Resource |
|---|---|
| https://github.com/xwiki/xwiki-platform/commit/82aa670106c7f5e6238ca6ed59a52d1800e05b99 | Patch |
| https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gfp2-6qhm-7x43 | Vendor Advisory |
| https://jira.xwiki.org/browse/XWIKI-22490 | Exploit Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
13 May 2025, 13:34
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-862 | |
| First Time |
Xwiki
Xwiki xwiki |
|
| References | () https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gfp2-6qhm-7x43 - Vendor Advisory | |
| References | () https://github.com/xwiki/xwiki-platform/commit/82aa670106c7f5e6238ca6ed59a52d1800e05b99 - Patch | |
| References | () https://jira.xwiki.org/browse/XWIKI-22490 - Exploit, Issue Tracking, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:a:xwiki:xwiki:5.4:rc1:*:*:*:*:*:* cpe:2.3:a:xwiki:xwiki:5.4:-:*:*:*:*:*:* cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:* |
19 Mar 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-19 18:15
Updated : 2025-05-13 13:34
NVD link : CVE-2025-29926
Mitre link : CVE-2025-29926
JSON object : View
Products Affected
xwiki
- xwiki