XWiki makes title of inaccessible pages available through the class property values REST API

🗓️ 13 Jun 2025 20:42:12Reported by GitHub Advisory DatabaseType

Title of inaccessible XWiki pages can be retrieved via the class property values REST API, affecting confidentiality.

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, relates to the disclosure of information during data transmission. This vulnerability allows attackers to gain unauthorized access to protected information.	19 Sep 202500:00	–	bdu_fstec
Circl	CVE-2025-49584	13 Jun 202517:38	–	circl
CNNVD	XWiki Platform 安全漏洞	13 Jun 202500:00	–	cnnvd
CVE	CVE-2025-49584	13 Jun 202517:21	–	cve
Cvelist	CVE-2025-49584 XWiki makes title of inaccessible pages available through the class property values REST API	13 Jun 202517:21	–	cvelist
EUVD	EUVD-2025-18305	3 Oct 202520:07	–	euvd
NVD	CVE-2025-49584	13 Jun 202518:15	–	nvd
OpenVAS	XWiki 10.9 < 16.4.7, 16.5.0-rc-1 < 16.10.3, 17.0.0-rc-1 < 17.0.0 Information Disclosure Vulnerability (GHSA-mvp5-qx9c-c3fv)	18 Jul 202500:00	–	openvas
OSV	CVE-2025-49584 XWiki makes title of inaccessible pages available through the class property values REST API	13 Jun 202517:21	–	osv
OSV	GHSA-MVP5-QX9C-C3FV XWiki makes title of inaccessible pages available through the class property values REST API	13 Jun 202520:42	–	osv

Vulners

Node

Source	Link
github	www.github.com/xwiki/xwiki-platform/security/advisories/GHSA-mvp5-qx9c-c3fv
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-49584
github	www.github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec
jira	www.jira.xwiki.org/browse/XWIKI-22736
github	www.github.com/advisories/GHSA-mvp5-qx9c-c3fv

13 Jun 2025 20:42Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.17.5

CVSS 48.7

EPSS0.00375

SSVC