{"id":"CVE-2025-54125","published":"2025-08-05T23:30:38Z","modified":"2025-08-06T20:29:03Z","title":"XWiki Platform: Password and email exposure in xml.vm fields","vendor":"xwiki","product":"xwiki-platform","tier":"core","eol":null,"affectedVersions":[{"vendor":"xwiki","product":"xwiki-platform","versions":[">= 1.1, < 16.4.7",">= 16.5.0-rc-1, < 16.10.5",">= 17.0.0-rc-1, < 17.2.0-rc-1"]}],"description":{"text":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 1.1 through 16.4.6, 16.5.0-rc-1 through 16.10.4 and 17.0.0-rc-1 through 17.1.0, the XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending ?xpage=xml to the URL includes password and email properties stored on a document that aren't named password or email. This is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1. To work around this issue, the file templates/xml.vm in the deployed WAR can be deleted if the XML isn't needed. There isn't any feature in XWiki itself that depends on the XML export.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":8.7,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01452,"percentile":0.73383,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-09-06","exploitedFirstSeen":"2025-09-06","ransomware":false,"evidence":[{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-54125","date":"2025-09-06"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-359","name":"Exposure of Private Personal Information to an Unauthorized Actor"}],"references":[{"url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-57q2-6cp4-9mq3","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xwiki/xwiki-platform/commit/742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59","tags":["x_refsource_MISC"]},{"url":"https://jira.xwiki.org/browse/XWIKI-22810","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-oldcore","vulnerableRanges":[">=1.1, <16.4.7",">=16.5.0-rc-1, <16.10.5",">=17.0.0-rc-1, <17.2.0-rc-1"],"patched":["16.4.7","16.10.5","17.2.0-rc-1"],"from":["GHSA-57q2-6cp4-9mq3"],"provenance":"source"},{"ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-legacy-oldcore","vulnerableRanges":[">=1.1, <16.4.7",">=16.5.0-rc-1, <16.10.5",">=17.0.0-rc-1, <17.2.0-rc-1"],"patched":["16.4.7","16.10.5","17.2.0-rc-1"],"from":["GHSA-57q2-6cp4-9mq3"],"provenance":"source"}],"advisories":[{"id":"GHSA-57q2-6cp4-9mq3","url":"https://github.com/advisories/GHSA-57q2-6cp4-9mq3","severity":"HIGH","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-oldcore","vulnerableRanges":[">=1.1, <16.4.7"],"patched":["16.4.7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-57q2-6cp4-9mq3","url":"https://github.com/advisories/GHSA-57q2-6cp4-9mq3","severity":"HIGH","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-oldcore","vulnerableRanges":[">=16.5.0-rc-1, <16.10.5"],"patched":["16.10.5"],"provenance":"source","from":"GHSA"},{"id":"GHSA-57q2-6cp4-9mq3","url":"https://github.com/advisories/GHSA-57q2-6cp4-9mq3","severity":"HIGH","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-oldcore","vulnerableRanges":[">=17.0.0-rc-1, <17.2.0-rc-1"],"patched":["17.2.0-rc-1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-57q2-6cp4-9mq3","url":"https://github.com/advisories/GHSA-57q2-6cp4-9mq3","severity":"HIGH","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-legacy-oldcore","vulnerableRanges":[">=1.1, <16.4.7"],"patched":["16.4.7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-57q2-6cp4-9mq3","url":"https://github.com/advisories/GHSA-57q2-6cp4-9mq3","severity":"HIGH","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-legacy-oldcore","vulnerableRanges":[">=16.5.0-rc-1, <16.10.5"],"patched":["16.10.5"],"provenance":"source","from":"GHSA"},{"id":"GHSA-57q2-6cp4-9mq3","url":"https://github.com/advisories/GHSA-57q2-6cp4-9mq3","severity":"HIGH","ecosystem":"Maven","package":"org.xwiki.platform:xwiki-platform-legacy-oldcore","vulnerableRanges":[">=17.0.0-rc-1, <17.2.0-rc-1"],"patched":["17.2.0-rc-1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-23670","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23670","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2025-54125","name":"XWiki XML View - Sensitive Information Exposure","severity":"high","path":"http/cves/2025/CVE-2025-54125.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54125.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-08-05","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-54125","provenance":"source"},{"date":"2025-09-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-54125","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":60.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 420 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":14.68,"detail":"percentile 0.7338"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.09,"detail":"base score 8.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2024-56158","published":"2025-06-12","fixed":"16.10.2","kev":false},{"cve":"CVE-2025-49586","published":"2025-06-13","fixed":"17.0.0","kev":false,"link":{"from":"CVE-2025-49586","to":"CVE-2025-54125","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-oldcore","fromFixed":"17.0.0","toFixed":"17.2.0-rc-1","daysApart":53},{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-oldcore","fromFixed":"16.10.3","toFixed":"16.10.5","daysApart":53}]}},{"cve":"CVE-2025-54124","published":"2025-08-05","fixed":"17.2.0-rc-1","kev":false},{"cve":"CVE-2025-54125","published":"2025-08-05","fixed":"17.2.0-rc-1","kev":false},{"cve":"CVE-2025-54385","published":"2025-07-26","fixed":"17.3.0-rc-1","kev":false},{"cve":"CVE-2026-33229","published":"2026-04-08","fixed":"17.10.1","kev":false,"link":{"from":"CVE-2025-54125","to":"CVE-2026-33229","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-legacy-oldcore","fromFixed":"17.2.0-rc-1","toFixed":"17.4.8","daysApart":246}]}},{"cve":"CVE-2026-40104","published":"2026-04-15","fixed":"17.10.1","kev":false,"link":{"from":"CVE-2025-54125","to":"CVE-2026-40104","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-legacy-oldcore","fromFixed":"17.2.0-rc-1","toFixed":"17.4.8","daysApart":253},{"kind":"version-step","provenance":"source","package":"Maven:org.xwiki.platform:xwiki-platform-legacy-oldcore","fromFixed":"16.10.5","toFixed":"16.10.16","daysApart":253}]}}],"package":"Maven:org.xwiki.platform:xwiki-platform-oldcore"}}