xwiki xwiki-platform up to 15.10.11/16.4.2/16.7.x Script API improper authorization

Summaryinfo

A vulnerability identified as critical has been detected in xwiki xwiki-platform up to 15.10.11/16.4.2/16.7.x. This issue affects some unknown processing of the component Script API. Performing a manipulation results in improper authorization. This vulnerability is identified as CVE-2025-32972. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in xwiki xwiki-platform up to 15.10.11/16.4.2/16.7.x. This affects some unknown functionality of the component Script API. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on availability. The summary by CVE is:

XWiki is a generic wiki platform. In versions starting from 6.1-milestone-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the script API of the LESS compiler in XWiki is incorrectly checking for rights when calling the cache cleaning API, making it possible to clean the cache without having programming right. The only impact of this is a slowdown in XWiki execution as the caches are re-filled. As this vulnerability requires script right to exploit, and script right already allows unlimited execution of scripts, the additional impact due to this vulnerability is low. This issue has been patched in versions 15.10.12, 16.4.3, and 16.8.0-rc-1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-32972 since 04/14/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. The exploitation needs additional levels of successful authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

Upgrading to version 15.10.12, 16.4.3 or 16.8.0-rc1 eliminates this vulnerability. Applying the patch 91752122d8782f171f8728004a57bdaefc34253e is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• xwiki

Name

• xwiki-platform

Version

• 15.10.0
• 15.10.1
• 15.10.2
• 15.10.3
• 15.10.4
• 15.10.5
• 15.10.6
• 15.10.7
• 15.10.8
• 15.10.9
• 15.10.10
• 15.10.11
• 16.0
• 16.1
• 16.2
• 16.3
• 16.4
• 16.4.0
• 16.4.1
• 16.4.2
• 16.5
• 16.6
• 16.7

License

• open-source

Website

• Product: https://github.com/xwiki/xwiki-platform/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion