CVE-2025-54124
- Source
- https://cve.org/CVERecord?id=CVE-2025-54124
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54124.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-54124
- Aliases
- Published
- 2025-08-05T23:28:07.166Z
- Modified
- 2026-08-05T09:31:40.194711Z
- Severity
-
- 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- XWiki Platform: Any user with editing rights can access password properties through Database List Properties
- Details
-
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 9.8-rc-1 through 16.4.6, 16.5.0-rc-1 through 16.10.4, and 17.0.0-rc-1 through 17.1.0, any user with editing rights can create an XClass with a database list property that references a password property. When adding an object of that XClass, the content of that password property is displayed. In practice, with a standard rights setup, this means that any user with an account on the wiki can access password hashes of all users, and possibly other password properties (with hashed or plain storage) that are on pages that the user can view. This issue is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1.
- Database specific
{ "cwe_ids": [ "CWE-359" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54124.json", "unresolved_ranges": [ { "source": "AFFECTED_FIELD", "extracted_events": [ { "introduced": "9.8-rc-1" }, { "fixed": "16.4.7" }, { "introduced": "16.5.0-rc-1" }, { "fixed": "16.10.5" }, { "introduced": "17.0.0-rc-1" }, { "fixed": "17.2.0-rc-1" } ] }, { "source": "DESCRIPTION", "extracted_events": [ { "introduced": "9.8-rc-1" }, { "fixed": "16.4.6" }, { "introduced": "16.5.0-rc-1" }, { "fixed": "16.10.4" }, { "introduced": "17.0.0-rc-1" }, { "fixed": "17.1.0" } ] } ] }- References
-
- https://jira.xwiki.org/browse/XWIKI-22811
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54124.json
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r38m-cgpg-qj69
- https://nvd.nist.gov/vuln/detail/CVE-2025-54124
- https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24
Affected packages
Git / github.com/xwiki/xwiki-platform
Affected versions
xwiki-platform-7.*
xwiki-platform-7.3-milestone-2
xwiki-platform-7.4-milestone-1
xwiki-platform-7.4-milestone-2
xwiki-platform-8.*
xwiki-platform-8.0-milestone-1
xwiki-platform-8.0-milestone-2
xwiki-platform-8.1-milestone-1
xwiki-platform-8.1-milestone-2
xwiki-platform-8.2-milestone-1
xwiki-platform-8.2-milestone-2
xwiki-platform-8.3-milestone-1
xwiki-platform-9.*
xwiki-platform-9.9-rc-2
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54124.json"
vanir_signatures
[
{
"source": "https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "25588946401877469368883697837870900964",
"length": 278.0
},
"id": "CVE-2025-54124-122d999a",
"target": {
"function": "assertQuery",
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilderTest.java"
},
"deprecated": false
},
{
"source": "https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "8565411168989470519648455557406968505",
"length": 525.0
},
"id": "CVE-2025-54124-2252b675",
"target": {
"function": "getStatementWhenIdOrValueFieldsAreSpecified",
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilder.java"
},
"deprecated": false
},
{
"source": "https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"9430737612104126761664851420056040295",
"232814941356848113137345721236504791193",
"119990194581517246625838795633665276734",
"267234776772717326609826758689299801215",
"194626504125535609403855122803490179103",
"249236333702770804220339674009796643091",
"86979270488880742015819241904343013029",
"191787495568820788386353291831381738004",
"316156611602210005911757058317079813348",
"145074299577700336584791207007534601691",
"207376324821807455774417225476855826604",
"16918185377285629193992726663966056052",
"86773165941627178512733047590175710475",
"309350962900639321504041114836239592776",
"6545238761161548852765113541895657655",
"184519221254701900262409628602974298979",
"19954025902313672387300834357174343639",
"76357480094675595296743706496325056181",
"21100514686129300411229723930476672096",
"261426417696032871443592661600408915210",
"139773600488288472628428203487004505973",
"159398918706843467195465288601134153776",
"35661851879181406057324047389755873513",
"258625132629845939921924379501107616008",
"311794320011510375412687169663254704925",
"332683154832639583281569014706722721197",
"131022618804411689102677023817805771580",
"198086118803829288386256498309394951071",
"312229950817486132124075850088531845709",
"235252927129811579246860266887680422061",
"20722929829990479611590000739158603051",
"280768559398315745104307181349609255458",
"325260339226706337086322288070392544906",
"136188500958400511325690304990030992700",
"234230796420224960847798805705347238403",
"41897987236082675802406637173711066616",
"244951874954603544754215467207246100988",
"302733611526470559036927469928039280389",
"127963255389892801074907302492917953887",
"300539661873332618209421603200711928758",
"23985872136856799177472281471113269193",
"124753308736566474181357199132730068897",
"288831957372422990250897282372825527905",
"264988369144360178465305514081083180394",
"30074746959010401056774180450183075338",
"12169587067235696465103933849481490760",
"21464395984059554186816832587531010713",
"151124289061124868845787746954526103262",
"55687235488837179153470695406688956020",
"261713734980704948038121983699606097486",
"331008866533146868237233074012767162279",
"183775170164620540784976721382539592082",
"19242472501377059004073966709254580625",
"87015345844325902596627298083391864833",
"25120267064679817459952925001309849032",
"42021516339337970156168621447037235948",
"314079068552986783026457087301967338414",
"294514039554706003510519417973834508120",
"47246775570181621128015147635503549200",
"256222781277228200903276524924602361252",
"186495780612956694628396676429621063508",
"154059794178047699039970640934873635269",
"149235955086545417552905336368749651930",
"107614266355376204595652731990368345368",
"248854171503436428570657465903566197648",
"168433355261322413016204227799686129217",
"254714358950712411935644515984102876717",
"34813886275789742989898821243747340446",
"157579904967092812505224556778042342214",
"246894696901175662191072202425767328987",
"9566792057004915941738565526294210090"
],
"threshold": 0.9
},
"id": "CVE-2025-54124-6b829455",
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilderTest.java"
},
"deprecated": false
},
{
"source": "https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "153217571392003286122272293474929253064",
"length": 1459.0
},
"id": "CVE-2025-54124-6cb7946d",
"target": {
"function": "getStatementWhenIdFieldIsSpecified",
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilder.java"
},
"deprecated": false
},
{
"source": "https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "307823744661072181184920036927472797345",
"length": 528.0
},
"id": "CVE-2025-54124-7ce7be8a",
"target": {
"function": "addFieldToQuery",
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilder.java"
},
"deprecated": false
},
{
"source": "https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"230858229873406835534393344686209283206",
"57608221344348083845724934030115009349",
"13153002476370662215552005562743474463",
"195856933316167992070229943307207098034",
"313750038001224873922536706004627100203",
"107594134025218679778079705293910751254",
"278564690786023840406836389456147212028",
"213297694565389891885139239680313799940",
"262715718945567333297458278851601465607",
"272050620557458171320020100815678534586",
"301825700194826585776811522400358319267",
"231380269004861631747211174307692962769",
"317559028041180602673305018438272918339",
"212480594403909680286443468144418005492",
"120981174045823506109930506847088308720",
"335355690711749491120177704511418336358",
"70726860669442020250621325197240866197",
"193076965279154054974981026016935596823",
"242001531817141354982158598897344539095",
"234204687429283437563883883949534491066",
"125506146143484036724096383059685088187",
"58793186728997274535163326360399667478",
"296865274879879115424771965600981719777",
"55850783724821463411946782124873553907",
"286948810215121984500798122269040703089",
"87879334640435543146488061256637071113",
"318544225186794719682318624864587137246",
"191763487303751778763733542077524729016",
"156836061001278471892762245676638507135",
"283436706751665912036526831029877937087",
"12545969314674239680792604543456265493",
"209859634803940457209407482945253208911",
"54444722187118174594013259224784086968",
"8659739287308300024475486687530586241",
"278889315781478408975317224799096045599",
"173493026909964655720970758913680697659",
"178826314398077703352073456727339784137",
"263130243135541702042006002514404698037",
"64389203643994276852895635898120335302",
"33144240593021047945382548904743460184",
"327285510551167026225099830859407820254",
"279181360975741440744906491382222404317",
"30273994894879301499354625685863319604",
"152267674513638299472550744258593708482",
"41543576488846275991680623292970284049",
"85923158625666762609851596431083000135",
"106146486446252204002856992856153950081",
"325903631368572804344522534399210387047",
"179791636828333472512996385188758731719",
"151628863395879411413848295853109089685",
"70097959204253015832142851682673689396",
"312101828913823249499696853558381185210"
],
"threshold": 0.9
},
"id": "CVE-2025-54124-a3bebb75",
"target": {
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilder.java"
},
"deprecated": false
},
{
"source": "https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"function_hash": "211526893444501261481378754755513416636",
"length": 392.0
},
"id": "CVE-2025-54124-b2a0793f",
"target": {
"function": "configure",
"file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilderTest.java"
},
"deprecated": false
}
]
vanir_signatures_modified
"2026-08-05T09:31:40Z"