CVE-2025-49584 XWiki makes title of inaccessible pages available through the class property values REST API

🗓️ 13 Jun 2025 17:21:33Reported by GitHub_MType

XWiki REST API exposes inaccessible page titles; fixed in multiple versions by adding access controls.

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, relates to the disclosure of information during data transmission. This vulnerability allows attackers to gain unauthorized access to protected information.	19 Sep 202500:00	–	bdu_fstec
Circl	CVE-2025-49584	13 Jun 202517:38	–	circl
CNNVD	XWiki Platform 安全漏洞	13 Jun 202500:00	–	cnnvd
CVE	CVE-2025-49584	13 Jun 202517:21	–	cve
EUVD	EUVD-2025-18305	3 Oct 202520:07	–	euvd
Github Security Blog	XWiki makes title of inaccessible pages available through the class property values REST API	13 Jun 202520:42	–	github
NVD	CVE-2025-49584	13 Jun 202518:15	–	nvd
OpenVAS	XWiki 10.9 < 16.4.7, 16.5.0-rc-1 < 16.10.3, 17.0.0-rc-1 < 17.0.0 Information Disclosure Vulnerability (GHSA-mvp5-qx9c-c3fv)	18 Jul 202500:00	–	openvas
OSV	CVE-2025-49584 XWiki makes title of inaccessible pages available through the class property values REST API	13 Jun 202517:21	–	osv
OSV	GHSA-MVP5-QX9C-C3FV XWiki makes title of inaccessible pages available through the class property values REST API	13 Jun 202520:42	–	osv

[
  {
    "vendor": "xwiki",
    "product": "xwiki-platform",
    "versions": [
      {
        "version": ">= 10.9, < 16.4.7",
        "status": "affected"
      },
      {
        "version": ">= 16.5.0-rc-1, < 16.10.3",
        "status": "affected"
      },
      {
        "version": ">= 17.0.0-rc-1, < 17.0.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
jira	www.jira.xwiki.org/browse/XWIKI-22736
github	www.github.com/xwiki/xwiki-platform/security/advisories/GHSA-mvp5-qx9c-c3fv
github	www.github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec

13 Jun 2025 17:21Current

CVSS 48.7

EPSS0.00375

CWE-201