CVE-2025-29925

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-29925
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-29925.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-29925
Aliases
Published
2025-03-19T17:36:28.066Z
Modified
2026-04-02T12:46:51.279269Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
XWiki allows unregistered users to access private pages information through REST endpoint
Details

XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with "Prevent unregistered user to view pages": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29925.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-402"
    ]
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
3c19c915c7460e7fcd1b290f16797912b9bec695
Fixed
26b3bc4fcbf373467d4a70e7127a758dcc37c430
Database specific 
{
    "versions": [
        {
            "introduced": "1.9M1"
        },
        {
            "fixed": "15.10.14"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
6f103dbca9c98cf3b53bfadb83d982facb198d56
Fixed
5292357f68df062a1b2f6a48410c3753e94771d3
Database specific 
{
    "versions": [
        {
            "introduced": "16.0.0-rc-1"
        },
        {
            "fixed": "16.4.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
ed06c998964cae931ccfe7005a67eeaedaf60e58
Fixed
12d3595f5d2056af73f65f30211a5085a35cb1ce
Database specific 
{
    "versions": [
        {
            "introduced": "16.5.0-rc-1"
        },
        {
            "fixed": "16.10.0-rc-1"
        }
    ]
}

Affected versions

xwiki-platform-16.*
xwiki-platform-16.0.0
xwiki-platform-16.0.0-rc-1
xwiki-platform-16.5.0
xwiki-platform-16.5.0-rc-1
xwiki-web-1.*
xwiki-web-1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-29925.json"