DeutschShown in its original language — a full translation is planned for a future version.
xwiki: Mehrere Schwachstellen
view advisory published 2025-06-12
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in xwiki ausnutzen, um seine Privilegien zu erhöhen, beliebigen Programmcode auszuführen, Informationen auszuspähen, Cross-Site-Scripting auszuführen oder weitere nicht spezifizierte Auswirkungen zu erzielen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-49587US | high8.0 | — | ||
XWiki is an open-source wiki software platform. When a user without script right creates a document with an XWiki.Notifications.Code.NotificationDisplayerClass object, and later an… | ||||
| CVE-2025-49586US | high8.8OT elevated | — | ||
XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki) can obtain programmi… | ||||
| CVE-2025-49585US | high8.0 | — | ||
XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or programming right cre… | ||||
| CVE-2025-49584US | high7.5 | — | ||
XWiki is a generic wiki platform. In XWiki Platform versions 10.9 through 16.4.6, 16.5.0-rc-1 through 16.10.2, and 17.0.0-rc-1, the title of every single page whose reference is kn… | ||||
| CVE-2025-49583US | low3.5 | — | ||
XWiki is a generic wiki platform. When a user without script right creates a document with an `XWiki.Notifications.Code.NotificationEmailRendererClass` object, and later an admin e… | ||||
| CVE-2025-49582US | high8.0 | — | ||
XWiki is a generic wiki platform. When editing content that contains "dangerous" macros like malicious script macros that were authored by a user with fewer rights, XWiki warns abo… | ||||
| CVE-2025-49581US | high8.8 | — | ||
XWiki is a generic wiki platform. Any user with edit right on a page (could be the user's profile) can execute code (Groovy, Python, Velocity) with programming right by defining a… | ||||
| CVE-2025-49580US | high8.0 | — | ||
XWiki is a generic wiki platform. From 8.2 and 7.4.5 until 17.1.0-rc-1, 16.10.4, and 16.4.7, pages can gain script or programming rights when they contain a link and the target of… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-59w6-r9hm-439h vom 2025-06-12external
- GitHub Security Advisory GHSA-9875-cw22-f7cx vom 2025-06-12external
- GitHub Security Advisory GHSA-c32m-27pj-4xcj vom 2025-06-12external
- GitHub Security Advisory GHSA-ff6v-w58f-v97w vom 2025-06-12external
- GitHub Security Advisory GHSA-j7p2-87q3-44w7 vom 2025-06-12external
- GitHub Security Advisory GHSA-jm43-hrq7-r7w6 vom 2025-06-12external
- GitHub Security Advisory GHSA-jp4x-w9cj-97q7 vom 2025-06-12external
- GitHub Security Advisory GHSA-mvp5-qx9c-c3fv vom 2025-06-12external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan