CVE-2025-32972

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-32972
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32972.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-32972
Aliases
Published
2025-04-30T14:54:58.945Z
Modified
2026-08-12T15:16:28.705882Z
Severity
  • 2.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
The lesscss script service allows cache clearing without programming right
Details

XWiki is a generic wiki platform. In versions starting from 6.1-milestone-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the script API of the LESS compiler in XWiki is incorrectly checking for rights when calling the cache cleaning API, making it possible to clean the cache without having programming right. The only impact of this is a slowdown in XWiki execution as the caches are re-filled. As this vulnerability requires script right to exploit, and script right already allows unlimited execution of scripts, the additional impact due to this vulnerability is low. This issue has been patched in versions 15.10.12, 16.4.3, and 16.8.0-rc-1.

Database specific 
{
    "cwe_ids": [
        "CWE-285"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32972.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
c7b2fe24e1384a01ffebb4feaf1566a8bbbde153
Fixed
a75114d3e9875bc3383329fa44f9b47bf2871762
Introduced
918ea43fe0d277c28efa21a871175b329c75157c
Fixed
a74a28b426e394510b9cebcf261fc91853719acf
Introduced
526fcc68b3f75862a2af7395b5a6dfdd3d2166a5
Fixed
b7e6ace16af1a52758fb881837d1d05f6f51a418
Introduced
e4fc52610e9a8fb76a5cbe2e1282077e5757d18f
Last affected
029f39adf510c8be3c4b6cf8b75ba1abdc622aee
Database specific
Show details 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:6.1:-:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:6.1:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:6.1:milestone2:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "6.2"
        },
        {
            "fixed": "15.10.12"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.4.3"
        },
        {
            "introduced": "16.5.0"
        },
        {
            "fixed": "16.8.0"
        },
        {
            "introduced": "6.1-NA"
        },
        {
            "last_affected": "6.1-NA"
        },
        {
            "introduced": "6.1-milestone1"
        },
        {
            "last_affected": "6.1-milestone1"
        },
        {
            "introduced": "6.1-milestone2"
        },
        {
            "last_affected": "6.1-milestone2"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
c427b927d0904c5989881dbf21d3f486eb0bf4ed
Fixed
6914819340c6e94b51b7e5c68613f47831d4996b
Introduced
3c6f5cf138d8095f63631e554ba448e4b780e162
Fixed
82ba90784232fd5947c70b74bbbcfc67a245aca1
Introduced
177e524c2e218fe5de776619271b7cd12c929488
Fixed
49af0ac677c5f80e29ec8044c81ac51d3161152a
Introduced
9ef3ab7e28c42689836581232bf27ef84c15d80d
Fixed
91752122d8782f171f8728004a57bdaefc34253e
Database specific
Show details 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "cpe": [
        "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:6.1:-:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:6.1:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:xwiki:xwiki:6.1:milestone2:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "6.2"
        },
        {
            "fixed": "15.10.12"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "16.4.3"
        },
        {
            "introduced": "16.5.0"
        },
        {
            "fixed": "16.8.0"
        },
        {
            "introduced": "6.1-NA"
        },
        {
            "last_affected": "6.1-NA"
        },
        {
            "introduced": "6.1-milestone1"
        },
        {
            "last_affected": "6.1-milestone1"
        },
        {
            "introduced": "6.1-milestone2"
        },
        {
            "last_affected": "6.1-milestone2"
        }
    ]
}

Affected versions

6.*
6.1-NA
6.1-milestone1
6.1-milestone2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32972.json"
vanir_signatures 
[
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "35590578146992370760656817731770362413",
            "length": 722.0
        },
        "target": {
            "function": "clearCacheFromSkinWithRights",
            "file": "xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/test/java/org/xwiki/lesscss/LessCompilerScriptServiceTest.java"
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e",
        "signature_version": "v1",
        "id": "CVE-2025-32972-175ad00c",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "90003973987172840059795540001675420323",
            "length": 740.0
        },
        "target": {
            "function": "clearCacheFromColorThemeWithRights",
            "file": "xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/test/java/org/xwiki/lesscss/LessCompilerScriptServiceTest.java"
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e",
        "signature_version": "v1",
        "id": "CVE-2025-32972-52df2211",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "82072351446255376812064518143874372063",
            "length": 560.0
        },
        "target": {
            "function": "clearCacheWithoutRights",
            "file": "xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/test/java/org/xwiki/lesscss/LessCompilerScriptServiceTest.java"
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e",
        "signature_version": "v1",
        "id": "CVE-2025-32972-681d47ff",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "320779907900395051694057517481811362083",
            "length": 431.0
        },
        "target": {
            "function": "clearCacheFromSkin",
            "file": "xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/main/java/org/xwiki/lesscss/LessCompilerScriptService.java"
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e",
        "signature_version": "v1",
        "id": "CVE-2025-32972-79c8301b",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "331036458359052477026087195607800271695",
            "length": 294.0
        },
        "target": {
            "function": "clearCache",
            "file": "xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/main/java/org/xwiki/lesscss/LessCompilerScriptService.java"
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e",
        "signature_version": "v1",
        "id": "CVE-2025-32972-7c8765da",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "26354114674643914098251582149836110712",
                "122847670437072630553813708767699808279",
                "301330648091290856480467200251575557494",
                "86948520880146597500638078515848682601",
                "286473275462433612255082425437475686932",
                "274352027171814714020433640641895897347",
                "153476407581812448728379984577941774650",
                "36748194502398627378493192014563423147",
                "153650642303657305414645751234824221766",
                "263752687113836107815150453966292684458",
                "324861828093085968870195840319973273244",
                "176680763033700629276087172620858050660",
                "173940358028824358514941389478414562039",
                "295981392241568271245851678409312877021",
                "231635045086134250331591898615540716758",
                "8598238072392787981035094254468975827",
                "201160888845140050564852946208570043728",
                "247551474549901120190500739959035903127",
                "46328983190908827366560857761069965034",
                "100843318339168826946141409620491459066",
                "134530280904772884079572198308452398798",
                "3014832254704088645877918123451933656",
                "151608077193962395205570599271218733956",
                "253636885997382931081066850782323165344",
                "73804854254818670018083243962884070297",
                "155527883425575336622186403424120640938",
                "104015779212699421005483466368883451159",
                "3014832254704088645877918123451933656",
                "151608077193962395205570599271218733956",
                "253636885997382931081066850782323165344",
                "245113522653022835975415625012589107846",
                "334878905600961254475810376464862369495",
                "286681707528832347853776830604409278321",
                "3014832254704088645877918123451933656",
                "151608077193962395205570599271218733956",
                "253636885997382931081066850782323165344",
                "245113522653022835975415625012589107846"
            ]
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/main/java/org/xwiki/lesscss/LessCompilerScriptService.java"
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e",
        "signature_version": "v1",
        "id": "CVE-2025-32972-85592d7b",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "24471483877104981484459232270747184483",
            "length": 437.0
        },
        "target": {
            "function": "clearCacheFromColorTheme",
            "file": "xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/main/java/org/xwiki/lesscss/LessCompilerScriptService.java"
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e",
        "signature_version": "v1",
        "id": "CVE-2025-32972-94846df1",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "243256167117571337895056020292673834625",
            "length": 573.0
        },
        "target": {
            "function": "clearCacheFromColorThemeWithoutRights",
            "file": "xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/test/java/org/xwiki/lesscss/LessCompilerScriptServiceTest.java"
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e",
        "signature_version": "v1",
        "id": "CVE-2025-32972-b5d87ace",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "47257735988333529455222790735845656460",
            "length": 589.0
        },
        "target": {
            "function": "clearCacheWithRights",
            "file": "xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/test/java/org/xwiki/lesscss/LessCompilerScriptServiceTest.java"
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e",
        "signature_version": "v1",
        "id": "CVE-2025-32972-c4738e91",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "67495178266199656474776340267351627445",
            "length": 567.0
        },
        "target": {
            "function": "clearCacheFromSkinWithoutRights",
            "file": "xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/test/java/org/xwiki/lesscss/LessCompilerScriptServiceTest.java"
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e",
        "signature_version": "v1",
        "id": "CVE-2025-32972-e6a954fd",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "8530559662151459972565004054198710690",
                "120867000324663890123402093787590803449",
                "298360063325840311120890685337061460157",
                "289849621706375707740750179983022806095",
                "82438302340837852241171746182390400541",
                "250463202435729184047226704144961056942",
                "134141265639701617773075904164679762691",
                "313857156246645670003548288670575606359",
                "339741787043539873769506372889568992776",
                "317271996167258544138831681519695054084",
                "198360998782893633262631085754804720380",
                "337059962214239611254703979440267923230",
                "283505832479442296594998392059062770419",
                "50387266226148308870716824965847541097",
                "185905045048758120967181260671958377608",
                "199322783334443109153201596635245680898",
                "328830729389762730052539085865397241511",
                "128423991711865999419976302831926995367",
                "122125706197825976152840539678398969859",
                "179291757978757140930595631820755819540",
                "283505832479442296594998392059062770419",
                "100228635625201181189785279989684543730",
                "28248475088257421734657325021442808590",
                "170276784351170133688633550666439336728",
                "328830729389762730052539085865397241511",
                "314135951855850568371304621985805311184",
                "157393389003104658903706098726165691765",
                "96132357251727382323635709079272040671",
                "202892845440725699784175262217462372191",
                "74030793613587768650294872271910637210",
                "176759970996124561491525196914738500810",
                "283505832479442296594998392059062770419",
                "180196826741541800616720987866703442572",
                "158476025152132506480981525650694847984",
                "279940992644320497525644768820852875483",
                "328830729389762730052539085865397241511",
                "283341982703186656712102047206086442710",
                "258359756719039924232822270639396562023",
                "247448104874748068543160301149657223823",
                "136706969352643176391896878269797158365"
            ]
        },
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/test/java/org/xwiki/lesscss/LessCompilerScriptServiceTest.java"
        },
        "source": "https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e",
        "signature_version": "v1",
        "id": "CVE-2025-32972-fc7f50c1",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-08-12T15:16:28Z"