org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right

🗓️ 29 Apr 2025 14:03:13Reported by GitHub Advisory DatabaseType

No warning when granting programming right via XWiki.ComponentClass poses security risk for users.

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerability of the org.xwiki.platform:xwiki-platform-component-wiki component of the XWiki Platform, a platform for creating collaborative web applications, allows a perpetrator to gain unauthorized access to protected information.	9 May 202500:00	–	bdu_fstec
Circl	CVE-2025-32973	30 Apr 202515:48	–	circl
CNNVD	XWiki Platform 安全漏洞	30 Apr 202500:00	–	cnnvd
CVE	CVE-2025-32973	30 Apr 202514:55	–	cve
Cvelist	CVE-2025-32973 org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right	30 Apr 202514:55	–	cvelist
EUVD	EUVD-2025-12741	3 Oct 202520:07	–	euvd
NVD	CVE-2025-32973	30 Apr 202515:16	–	nvd
OpenVAS	XWiki 15.9-rc-1 < 15.10.12, 16.0.0-rc-1 < 16.4.3, 16.5.0-rc-1 < 16.8.0 Privilege Escalation Vulnerability (GHSA-x7wv-5qg4-vmr6)	18 Jul 202500:00	–	openvas
OSV	CVE-2025-32973 org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right	30 Apr 202514:55	–	osv
OSV	GHSA-X7WV-5QG4-VMR6 org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right	29 Apr 202514:03	–	osv

Vulners

Node

Source	Link
github	www.github.com/xwiki/xwiki-platform/security/advisories/GHSA-x7wv-5qg4-vmr6
github	www.github.com/xwiki/xwiki-platform/commit/1a6f1b2e050770331c9a63d12a3fd8a36d199f62
jira	www.jira.xwiki.org/browse/XWIKI-22460
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-32973
github	www.github.com/advisories/GHSA-x7wv-5qg4-vmr6

30 Apr 2025 17:29Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.19

EPSS0.01384

SSVC