CVE-2025-54124

Source
https://cve.org/CVERecord?id=CVE-2025-54124
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54124.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-54124
Aliases
Published
2025-08-05T23:28:07.166Z
Modified
2026-08-05T09:31:40.194711Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
XWiki Platform: Any user with editing rights can access password properties through Database List Properties
Details

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 9.8-rc-1 through 16.4.6, 16.5.0-rc-1 through 16.10.4, and 17.0.0-rc-1 through 17.1.0, any user with editing rights can create an XClass with a database list property that references a password property. When adding an object of that XClass, the content of that password property is displayed. In practice, with a standard rights setup, this means that any user with an account on the wiki can access password hashes of all users, and possibly other password properties (with hashed or plain storage) that are on pages that the user can view. This issue is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1.

Database specific
{
    "cwe_ids": [
        "CWE-359"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54124.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "9.8-rc-1"
                },
                {
                    "fixed": "16.4.7"
                },
                {
                    "introduced": "16.5.0-rc-1"
                },
                {
                    "fixed": "16.10.5"
                },
                {
                    "introduced": "17.0.0-rc-1"
                },
                {
                    "fixed": "17.2.0-rc-1"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "9.8-rc-1"
                },
                {
                    "fixed": "16.4.6"
                },
                {
                    "introduced": "16.5.0-rc-1"
                },
                {
                    "fixed": "16.10.4"
                },
                {
                    "introduced": "17.0.0-rc-1"
                },
                {
                    "fixed": "17.1.0"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Database specific
{
    "source": "REFERENCES"
}

Affected versions

xwiki-platform-7.*
xwiki-platform-7.3-milestone-2
xwiki-platform-7.4-milestone-1
xwiki-platform-7.4-milestone-2
xwiki-platform-8.*
xwiki-platform-8.0-milestone-1
xwiki-platform-8.0-milestone-2
xwiki-platform-8.1-milestone-1
xwiki-platform-8.1-milestone-2
xwiki-platform-8.2-milestone-1
xwiki-platform-8.2-milestone-2
xwiki-platform-8.3-milestone-1
xwiki-platform-9.*
xwiki-platform-9.9-rc-2

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54124.json"
vanir_signatures
[
    {
        "source": "https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "25588946401877469368883697837870900964",
            "length": 278.0
        },
        "id": "CVE-2025-54124-122d999a",
        "target": {
            "function": "assertQuery",
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilderTest.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "8565411168989470519648455557406968505",
            "length": 525.0
        },
        "id": "CVE-2025-54124-2252b675",
        "target": {
            "function": "getStatementWhenIdOrValueFieldsAreSpecified",
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilder.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "9430737612104126761664851420056040295",
                "232814941356848113137345721236504791193",
                "119990194581517246625838795633665276734",
                "267234776772717326609826758689299801215",
                "194626504125535609403855122803490179103",
                "249236333702770804220339674009796643091",
                "86979270488880742015819241904343013029",
                "191787495568820788386353291831381738004",
                "316156611602210005911757058317079813348",
                "145074299577700336584791207007534601691",
                "207376324821807455774417225476855826604",
                "16918185377285629193992726663966056052",
                "86773165941627178512733047590175710475",
                "309350962900639321504041114836239592776",
                "6545238761161548852765113541895657655",
                "184519221254701900262409628602974298979",
                "19954025902313672387300834357174343639",
                "76357480094675595296743706496325056181",
                "21100514686129300411229723930476672096",
                "261426417696032871443592661600408915210",
                "139773600488288472628428203487004505973",
                "159398918706843467195465288601134153776",
                "35661851879181406057324047389755873513",
                "258625132629845939921924379501107616008",
                "311794320011510375412687169663254704925",
                "332683154832639583281569014706722721197",
                "131022618804411689102677023817805771580",
                "198086118803829288386256498309394951071",
                "312229950817486132124075850088531845709",
                "235252927129811579246860266887680422061",
                "20722929829990479611590000739158603051",
                "280768559398315745104307181349609255458",
                "325260339226706337086322288070392544906",
                "136188500958400511325690304990030992700",
                "234230796420224960847798805705347238403",
                "41897987236082675802406637173711066616",
                "244951874954603544754215467207246100988",
                "302733611526470559036927469928039280389",
                "127963255389892801074907302492917953887",
                "300539661873332618209421603200711928758",
                "23985872136856799177472281471113269193",
                "124753308736566474181357199132730068897",
                "288831957372422990250897282372825527905",
                "264988369144360178465305514081083180394",
                "30074746959010401056774180450183075338",
                "12169587067235696465103933849481490760",
                "21464395984059554186816832587531010713",
                "151124289061124868845787746954526103262",
                "55687235488837179153470695406688956020",
                "261713734980704948038121983699606097486",
                "331008866533146868237233074012767162279",
                "183775170164620540784976721382539592082",
                "19242472501377059004073966709254580625",
                "87015345844325902596627298083391864833",
                "25120267064679817459952925001309849032",
                "42021516339337970156168621447037235948",
                "314079068552986783026457087301967338414",
                "294514039554706003510519417973834508120",
                "47246775570181621128015147635503549200",
                "256222781277228200903276524924602361252",
                "186495780612956694628396676429621063508",
                "154059794178047699039970640934873635269",
                "149235955086545417552905336368749651930",
                "107614266355376204595652731990368345368",
                "248854171503436428570657465903566197648",
                "168433355261322413016204227799686129217",
                "254714358950712411935644515984102876717",
                "34813886275789742989898821243747340446",
                "157579904967092812505224556778042342214",
                "246894696901175662191072202425767328987",
                "9566792057004915941738565526294210090"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-54124-6b829455",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilderTest.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "153217571392003286122272293474929253064",
            "length": 1459.0
        },
        "id": "CVE-2025-54124-6cb7946d",
        "target": {
            "function": "getStatementWhenIdFieldIsSpecified",
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilder.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "307823744661072181184920036927472797345",
            "length": 528.0
        },
        "id": "CVE-2025-54124-7ce7be8a",
        "target": {
            "function": "addFieldToQuery",
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilder.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "230858229873406835534393344686209283206",
                "57608221344348083845724934030115009349",
                "13153002476370662215552005562743474463",
                "195856933316167992070229943307207098034",
                "313750038001224873922536706004627100203",
                "107594134025218679778079705293910751254",
                "278564690786023840406836389456147212028",
                "213297694565389891885139239680313799940",
                "262715718945567333297458278851601465607",
                "272050620557458171320020100815678534586",
                "301825700194826585776811522400358319267",
                "231380269004861631747211174307692962769",
                "317559028041180602673305018438272918339",
                "212480594403909680286443468144418005492",
                "120981174045823506109930506847088308720",
                "335355690711749491120177704511418336358",
                "70726860669442020250621325197240866197",
                "193076965279154054974981026016935596823",
                "242001531817141354982158598897344539095",
                "234204687429283437563883883949534491066",
                "125506146143484036724096383059685088187",
                "58793186728997274535163326360399667478",
                "296865274879879115424771965600981719777",
                "55850783724821463411946782124873553907",
                "286948810215121984500798122269040703089",
                "87879334640435543146488061256637071113",
                "318544225186794719682318624864587137246",
                "191763487303751778763733542077524729016",
                "156836061001278471892762245676638507135",
                "283436706751665912036526831029877937087",
                "12545969314674239680792604543456265493",
                "209859634803940457209407482945253208911",
                "54444722187118174594013259224784086968",
                "8659739287308300024475486687530586241",
                "278889315781478408975317224799096045599",
                "173493026909964655720970758913680697659",
                "178826314398077703352073456727339784137",
                "263130243135541702042006002514404698037",
                "64389203643994276852895635898120335302",
                "33144240593021047945382548904743460184",
                "327285510551167026225099830859407820254",
                "279181360975741440744906491382222404317",
                "30273994894879301499354625685863319604",
                "152267674513638299472550744258593708482",
                "41543576488846275991680623292970284049",
                "85923158625666762609851596431083000135",
                "106146486446252204002856992856153950081",
                "325903631368572804344522534399210387047",
                "179791636828333472512996385188758731719",
                "151628863395879411413848295853109089685",
                "70097959204253015832142851682673689396",
                "312101828913823249499696853558381185210"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-54124-a3bebb75",
        "target": {
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilder.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "211526893444501261481378754755513416636",
            "length": 392.0
        },
        "id": "CVE-2025-54124-b2a0793f",
        "target": {
            "function": "configure",
            "file": "xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilderTest.java"
        },
        "deprecated": false
    }
]
vanir_signatures_modified
"2026-08-05T09:31:40Z"