GHSA-mvgm-3rw2-7j4r

Source

https://github.com/advisories/GHSA-mvgm-3rw2-7j4r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-mvgm-3rw2-7j4r/GHSA-mvgm-3rw2-7j4r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mvgm-3rw2-7j4r

Aliases

CVE-2025-32974

Published

2025-04-29T14:05:54Z

Modified

2025-04-30T17:29:34Z

Severity

9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type

Details

Impact

When editing a page, XWiki warns since version 15.9 when there is content on the page like a script macro that would gain more rights due to the editing. This analysis doesn't consider certain kinds of properties, allowing a user to put malicious scripts in there that will be executed after a user with script, admin, or programming rights edited the page. Such a malicious script could impact the confidentiality, integrity and availability of the whole XWiki installation.

To reproduce, as a user without script right, create a class with a TextArea property, create page with an object of that class and a Velocity macro in its content. Then, as an admin, try editing that page. Normally, there should be a warning but in vulnerable versions of XWiki, there is no warning.

Patches

This vulnerability has been patched in XWiki 15.10.8 and 16.2.0.

Workarounds

We're not aware of any workarounds apart from not editing pages that might have been edited by untrusted users as a user with script rights, e.g., by using separate user accounts for admin and non-admin tasks.

Database specific

{
    "nvd_published_at": "2025-04-30T15:16:01Z",
    "cwe_ids": [
        "CWE-116",
        "CWE-269"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-29T14:05:54Z"
}

References

Affected packages

Maven / org.xwiki.platform:xwiki-platform-security-requiredrights-default

Package

Name: org.xwiki.platform:xwiki-platform-security-requiredrights-default; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-security-requiredrights-default

Affected ranges

Type: ECOSYSTEM
Events: Introduced

15.9-rc-1

Fixed

15.10.8

Maven / org.xwiki.platform:xwiki-platform-security-requiredrights-default

Package

Name: org.xwiki.platform:xwiki-platform-security-requiredrights-default; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.platform/xwiki-platform-security-requiredrights-default

Affected ranges

Type: ECOSYSTEM
Events: Introduced

16.0.0-rc-1

Fixed

16.2.0