xwikisas application-urlshortener up to 1.2.3 cross-site request forgery

Summaryinfo

A vulnerability classified as problematic has been found in xwikisas application-urlshortener up to 1.2.3. This impacts an unknown function. The manipulation leads to cross-site request forgery. This vulnerability is referenced as CVE-2025-48885. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in xwikisas application-urlshortener up to 1.2.3. It has been rated as problematic. This issue affects some unknown processing. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is integrity. The summary by CVE is:

application-urlshortener create shortened URLs for XWiki pages. Versions prior to 1.2.4 are vulnerable to users with view access being able to create arbitrary pages. Any user (even guests) can create these docs, even if they don't exist already. This can enable guest users to denature the structure of wiki pages, by creating 1000's of pages with random name, that then become very difficult to handle by admins. Version 1.2.4 fixes the issue. No known workarounds are available.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-48885 since 05/27/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.2.4 eliminates this vulnerability. Applying the patch f121a9c973fd25948e82efcb6289d53fe00a9e7d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• xwikisas

Name

• application-urlshortener

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3

License

• open-source

Website

• Product: https://github.com/xwikisas/application-urlshortener/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion