This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] XWiki fixes 2 vulnerabilities
XWiki fixes 2 vulnerabilities in versions 16.10.1, 16.4.6 and 15.10.16 [1][2].
An authenticated remote attacker with SCRIPT privilege can carry out an SQL injection attack, thereby gaining access to sensitive data such as password hashes. Depending on the database used, the attacker may potentially also be able to modify the password hashes. A PoC can be found at [1].
The vulnerability is present in product:
- XWiki; >=1.6, <15.10.16; >=16.4, <16.4.6; >=16.10, <16.10.1;
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
More information:
- CVE-2025-32968 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 23. 4. 2025.
An unauthenticated remote attacker can carry out an SQL injection attack using the REST API, thereby gaining access to sensitive data such as password hashes, even if access for unauthenticated users to view and edit web pages has been restricted. Depending on the database used, the attacker may potentially also be able to modify the password hashes. A PoC can be found at [2].
The vulnerability is present in product:
- XWiki; >=1.8, <15.10.16; >=16.4, <16.4.6; >=16.10, <16.10.1;
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
More information:
- CVE-2025-32969 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 23. 4. 2025.
Links
By CESNET, z.s.p.o. Martin Krajči on 25. 4. 2025.