SB2025022402 - Multiple vulnerabilities in XWiki platform

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025022402

SB2025022402 - Multiple vulnerabilities in XWiki platform

Published: February 24, 2025 Updated: April 17, 2026

Security Bulletin ID SB2025022402
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Code Injection (CVE-ID: CVE-2025-24893)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation within SolrSearchMacros request. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Code injection (CVE-ID: CVE-2024-55877)

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to code injection in macro descriptions rendered by XWiki.XWikiSyntaxMacrosList when processing a macro description from a user-added XWiki.WikiMacroClass object. A remote user can add a crafted XWiki.WikiMacroClass object to a page to execute arbitrary code.

The issue can be exploited by a connected user without script or programming rights.


3) Missing Authorization (CVE-ID: CVE-2025-23025)

The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper access control in the realtime WYSIWYG editor when handling realtime editing sessions involving users with script or programming rights. A remote user can insert a script rendering macro into edited content to escalate privileges.

User interaction is required, and exploitation depends on another participant in the same realtime editing session having script or programming rights.


Remediation

Install update from vendor's website.

References