CVE-2025-49580
BaseFortify
Publication date: 2025-06-13
Last updated on: 2025-09-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xwiki | xwiki | From 7.4.5 (inc) to 16.4.7 (exc) |
| xwiki | xwiki | From 16.5.0 (inc) to 16.10.4 (exc) |
| xwiki | xwiki | From 17.0.0 (inc) to 17.1.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in XWiki occurs when a page containing a link has its target renamed or moved during refactoring operations. Due to improper handling, the page can gain script or programming rights unintentionally, allowing execution of scripts embedded in XObjects that should never have been executed. This is a privilege escalation issue where the rights evaluation is affected by the refactoring process, potentially enabling unauthorized script execution. [2]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized execution of arbitrary scripts within the XWiki platform, which can compromise confidentiality, integrity, and availability of the system. An attacker with at least edit rights can create the initial condition, and the vulnerability requires user interaction with someone having higher privileges to perform the rename or move operation. This can result in privilege escalation and potential system compromise within the affected XWiki instance. [2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately upgrade the XWiki platform to one of the fixed versions: 17.1.0-rc-1, 16.10.4, or 16.4.7. If upgrading is not immediately possible, restrict refactoring operations (such as renaming or moving pages) to users without more than edit rights to prevent exploitation. Applying the patch specifically to the xwiki-platform-refactoring-default module is also advised. [2]