CVE-2025-49584

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-49584
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49584.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-49584
Aliases
Published
2025-06-13T17:21:33.575Z
Modified
2026-08-12T15:16:35.730112Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
XWiki makes title of inaccessible pages available through the class property values REST API
Details

XWiki is a generic wiki platform. In XWiki Platform versions 10.9 through 16.4.6, 16.5.0-rc-1 through 16.10.2, and 17.0.0-rc-1, the title of every single page whose reference is known can be accessed through the REST API as long as an XClass with a page property is accessible, this is the default for an XWiki installation. This allows an attacker to get titles of pages whose reference is known, one title per request. This doesn't affect fully private wikis as the REST endpoint checks access rights on the XClass definition. The impact on confidentiality depends on the strategy for page names. By default, page names match the title, so the impact should be low but if page names are intentionally obfuscated because the titles are sensitive, the impact could be high. This has been fixed in XWiki 16.4.7, 16.10.3 and 17.0.0 by adding access control checks before getting the title of any page.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49584.json",
    "cwe_ids": [
        "CWE-201"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
414fb113aceb2ce5f948d26835a2f3bc7df0d50b
Fixed
c3bb3381253c71df533fe0c31a02d3ce1e04bae7
Introduced
526fcc68b3f75862a2af7395b5a6dfdd3d2166a5
Fixed
1b4e258d6d1cbc10a803d3e071d038edb2d28b97
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "10.9"
        },
        {
            "fixed": "16.4.7"
        },
        {
            "introduced": "16.5.0"
        },
        {
            "fixed": "16.10.3"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*"
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
9d7ccc604c0981fe31efd8a265057906b2081d21
Fixed
f5a9a0762750936523187286919ec4c1892d6fea
Introduced
177e524c2e218fe5de776619271b7cd12c929488
Fixed
8cde0f326b60732330378e3ac10c630021e9cad7
Fixed
ee642f973a7c95d2d146fe03c81bcdee1871f4ec
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "10.9"
        },
        {
            "fixed": "16.4.7"
        },
        {
            "introduced": "16.5.0"
        },
        {
            "fixed": "16.10.3"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*"
}

Database specific

vanir_signatures 
[
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/PageClassPropertyValuesProvider.java"
        },
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "247737908986750908363155858902595652624",
                "267430052724371847144361948905731509059",
                "127540842794538490929952853403969333383",
                "63593931887475681361596090581152097990",
                "95450419653133474856080600837671723263",
                "179101817659455791493915737740166822403",
                "199025361995292072672423374625829225186",
                "136461563071304985128119582630726234236",
                "27047467332484193870438059072928333180",
                "335280221549889700107604319248013873855",
                "160851003329675005620317758286705503610",
                "301824742430404341073100970298186659064",
                "272084784876817986712213564934116428095",
                "209942931505294409457347998380974658450",
                "90086277529824800168415834825440536240",
                "37507739884213655242594748773750159991",
                "218116660305800784585153462217675049084",
                "307261160677155309788295688552011669756"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-03fdcda3"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/AbstractListClassPropertyValuesProviderTest.java"
        },
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "156752728491459665434696194984073776873",
                "132822041600642984619960262877907498821",
                "337385257650431302388376331287598810503",
                "284082868834099581173311384077046966683",
                "273109506575137068961150378187161451712",
                "200827839922356952540013242582324881950",
                "14934367230609982907745922690193124735",
                "80524719834316806653334361133149906696",
                "236568030158922429118270886039989657660",
                "291865506651925216735767626367558463391",
                "21201541050662820748985471872311856652",
                "42765113319045785820194954362516798044",
                "265384795873358464567949344488723599123",
                "29792046194386136714717797405754100468",
                "309868830143754697978134766163089164065",
                "62451475235261148623643260711897991895",
                "155636411496263798134800625447329411821",
                "320176734764370502817504815732379424670",
                "218985518932446063615835965144231013605",
                "7550824231317330175473423490766630711",
                "35575454470569963382285120707213280236",
                "162235616067638672743353387313727102707",
                "155595063283762533641862834675540251861",
                "147069211739879213312851296175995803198",
                "247922054257056416555863189873808900175",
                "289930429866351176411518062163220913103",
                "218349540286784876460866135646061146734",
                "224444799262732930642662857721899401371"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-05b1fe22"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/AbstractDocumentListClassPropertyValuesProvider.java"
        },
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "45102229131787161134129794195259022816",
                "15148942939027763578437364663610372952",
                "312098160621005355547844798455847465020",
                "154779772894130128970223941892063452276",
                "31641866773638191178433735489106646800",
                "278202581418378327690466917663450626449",
                "185361028414616349552451432345552259721",
                "105076118185251762716191665651387897291",
                "321683727844146523331663952540127420929",
                "3494217810212320204714183829507483991",
                "1080523246629092304419805005481126878"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-165db31e"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/PageClassPropertyValuesProvider.java",
            "function": "getLabel"
        },
        "signature_type": "Function",
        "digest": {
            "length": 543.0,
            "function_hash": "14378042723736434381145644890772087877"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-1c5c2e64"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/PageClassPropertyValuesProviderTest.java",
            "function": "getValuesWithTerminalPage"
        },
        "signature_type": "Function",
        "digest": {
            "length": 2125.0,
            "function_hash": "312584759197525879015548156089563469828"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-27a6fd44"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/PageClassPropertyValuesProviderTest.java"
        },
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "159612671607888667184468614472882410553",
                "172109912723709229122122669964036359835",
                "329516655351258160202165733929119163107",
                "291106183467248836959235127784236817768",
                "335121594807315134435178884515803317250",
                "61022799438741783664955949005065830613",
                "3818497134696403962601179360878606142",
                "288615183372711420803331942704028082362",
                "311831605474943844177437123166622867418",
                "44620087412673509678717651441464383245",
                "185932986602649290284051203558541718608",
                "191617783518316192257928596225904708561",
                "240519820518223752284773737785637491201",
                "193040098213903611501081945789158468740",
                "156690970409470233610389965437201768047",
                "86992130650277697588319001292194886933",
                "131074708782691749451023390938535569741",
                "253426425436940861813771079847645833069",
                "223888529045231920792539255928671708699",
                "121545858433858259808181788860231170668",
                "94358661260114109150632034619291749736",
                "285665828223360398376905595098901375418",
                "90620176822925035209308906872735778022",
                "58526485464675211678384950290389324531",
                "321156035114615853730583182624223458149",
                "239134284946250409375330040043589263155",
                "6245445309390285129468392971540533474",
                "18619836943923687198917504685745859474",
                "262158883148641798945050226999388577564",
                "207771939270556263910745123239038576278",
                "135590088493954916467694460745480451142",
                "48167833096664230229426470253553594528",
                "66800272593074309889710674657200899133",
                "107134440928808710279171493575294135268",
                "248539583390590088062010258192875763862",
                "119524654118627371521971806105467566824",
                "178550246420105305395083709340003138305",
                "223114386327426433556604326877854126084",
                "56533396705841587603080968035575482911",
                "207771939270556263910745123239038576278",
                "248632312618477404245924517715160096905",
                "231086230953574848271791017755163172476",
                "42843020749470484968400995831495486986",
                "80315372744537548205689975730225329913",
                "106258681813804435984163368909912224234",
                "294876340309680250025042074753626125807",
                "313764781720878175878821443486494174484",
                "277219632005972692255162518402584993932",
                "172881520019012183689967008737615564042"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-574026ea"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/GroupsClassPropertyValuesProvider.java",
            "function": "getIcon"
        },
        "signature_type": "Function",
        "digest": {
            "length": 1039.0,
            "function_hash": "276559334339863714229037384312915354950"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-8097fad8"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/UsersClassPropertyValuesProvider.java",
            "function": "getIcon"
        },
        "signature_type": "Function",
        "digest": {
            "length": 1106.0,
            "function_hash": "55303040393984022624833389419958653849"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-8745bdb7"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/UsersClassPropertyValuesProvider.java"
        },
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "78574802939534701696037118479721443758",
                "262632653147496385566394568833817756631",
                "90711065738190121288715203883598619127",
                "30418863133186240928359954259568934700",
                "165408608967512860981875196328819083302",
                "224025263015949403048385263800859742564",
                "301548366467436308030321827324026632746",
                "6593009407224709072185310887080442718",
                "309446517269005571868015244648640775597",
                "84486910026711355000776829036625695476",
                "213044029433551550513435494897747638380",
                "153632878859969747679830703449431547941",
                "336533508518923517306755023466768474295",
                "130352706656437423295683973397713427012",
                "20646642196911332464429632881785730720",
                "188350741282204207888252793221188824071",
                "219583642057884195348848094091833246550",
                "27323840758258474358220896722048600575",
                "79205503479849778674711125490915491001",
                "156877069020460533643944742923962104138",
                "202268236074648355218784602705261406826",
                "3769337030350747139407965888131991852"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-92dcadd1"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/AbstractDocumentListClassPropertyValuesProvider.java",
            "function": "getValue"
        },
        "signature_type": "Function",
        "digest": {
            "length": 446.0,
            "function_hash": "98469165261679720633192256304734899019"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-96b48f65"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/GroupsClassPropertyValuesProviderTest.java"
        },
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "10714916665244311502400453703612341454",
                "127881920231562937401359073603859142602",
                "260281550753435254094366451869812110190",
                "50911291492924950040979741858567437762",
                "132151965618256714521996207542416434169",
                "293152679478092789948730980016404688779",
                "298864847905384288958503937781666898924",
                "269466410000786879615505242765549871569",
                "169864761323538076109832247277862955915",
                "195799163325783940505067967757716257474",
                "168614012282558062018440968741343321778",
                "49507172460120888438862244359337860761",
                "236724518285972693662371316935060019339",
                "69471656533826696505556345143875130747",
                "15665426146033611044458651449886653711",
                "129778972221818241744150773320833549780",
                "148633691273869004604563874301017643895",
                "300459385187409380968301915252508857685",
                "163122918011877456820121971555813417888",
                "198880165266743174058633460952697225733",
                "211444459619927430752513043277599322522",
                "90551026909022285759957355073113942344",
                "112337213448040800929485329644059529283",
                "235061206531164615889962428056172215584",
                "279224175221165373747592349884135318319",
                "239082083059774290288071293796629654238",
                "289743310095826129241873450788160380314",
                "15844021061854683603277217075179156149",
                "184325020273824171612979063961265766204",
                "98245920623695534489539073742951124073",
                "54933699902025407693675276370195413335",
                "134038915815981856557972959687837291292",
                "38497703684947358471863542559761519437",
                "147709499968653069048852348226461640155"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-989b20e8"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/GroupsClassPropertyValuesProvider.java",
            "function": "getLabel"
        },
        "signature_type": "Function",
        "digest": {
            "length": 461.0,
            "function_hash": "317452003452074004568603034824774384211"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-989e8d92"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/UsersClassPropertyValuesProviderTest.java"
        },
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "168638991738471313688421490694306295903",
                "54593504555034901895097321294118326641",
                "260281550753435254094366451869812110190",
                "50911291492924950040979741858567437762",
                "31486935500204367861141541616138669360",
                "8269812889107629934058998997626535151",
                "170766177744077106380459216788141340896",
                "324789500597018918477630938339959642912",
                "181558684262218111831156430427372014441",
                "15665426146033611044458651449886653711",
                "129778972221818241744150773320833549780",
                "148633691273869004604563874301017643895",
                "300459385187409380968301915252508857685",
                "63303524642856752780760962478034372484",
                "20773022201551614371841110751404836069",
                "36125975653966261529194022216085253036",
                "192825404600669124295535883355264778935",
                "27442915510151779601989901938114799036",
                "312667302268284173402192149388027225002",
                "187199756849405234879338876092173426895",
                "300205197901768714405254194663136408455",
                "29511866159043091240560068971330922105",
                "36706071871783471628900012197715769504",
                "193020888950857140434304778647382585276",
                "71485184117655720295465312761091115756",
                "17983380798989321363085343879437167193",
                "58514053501137731651492763959811916429",
                "73449373131366501030644796712754767836"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-ab985102"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/UsersClassPropertyValuesProviderTest.java",
            "function": "getValuesLocal"
        },
        "signature_type": "Function",
        "digest": {
            "length": 3976.0,
            "function_hash": "173895688181633827773667548111410238195"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-b233980e"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/GroupsClassPropertyValuesProviderTest.java",
            "function": "getValuesLocal"
        },
        "signature_type": "Function",
        "digest": {
            "length": 2222.0,
            "function_hash": "164678246616924864227283845483164031031"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-b3cbfd6e"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/AbstractListClassPropertyValuesProviderTest.java",
            "function": "configure"
        },
        "signature_type": "Function",
        "digest": {
            "length": 898.0,
            "function_hash": "100254114779353006493733707240446980328"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-b6cee9a5"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/GroupsClassPropertyValuesProvider.java"
        },
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "166414000715344640459153174500385002518",
                "278860016259195573031161242873130114832",
                "103897316577602550855589274152623692711",
                "90202944096806929601969863048100178991",
                "224025263015949403048385263800859742564",
                "106021376449245013372190136712781939736",
                "121025296288160567180034911571948155018",
                "190071077906773303163509176107218508797",
                "240370049704121057559099821687666808628",
                "249168503052257881598012128027674004155",
                "293206405999384477974721238668072959196",
                "130352706656437423295683973397713427012",
                "20646642196911332464429632881785730720",
                "188350741282204207888252793221188824071",
                "163022116439903809640158807692472134660",
                "138646885214900172284404610026935361625",
                "221308398393138623587605099735425333951",
                "47865501250053962000260369307226917332",
                "180055672272117520046689121516332476420",
                "3769337030350747139407965888131991852",
                "69811253121480606737043109609503273407",
                "295474503075510992261967499087944173448",
                "78334745749388360936034080808357504064",
                "313475268025745319082594501612590203118",
                "257980748617232666523885280006578129678",
                "110834026136658225067902538202429093189",
                "95236561991913077533466049187753505226",
                "88541519937738299231900170046344506",
                "216633546480406730252057779432773752903",
                "321920622402928049170343891576885701982",
                "258597240667769088228086172497358040024"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-d6a88f8d"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/PageClassPropertyValuesProviderTest.java",
            "function": "getValues"
        },
        "signature_type": "Function",
        "digest": {
            "length": 1550.0,
            "function_hash": "169524343940508158302516448184993361016"
        },
        "deprecated": false,
        "source": "https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec",
        "id": "CVE-2025-49584-f8a75b24"
    }
]
vanir_signatures_modified 
"2026-08-12T15:16:35Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49584.json"