XWiki 10.9 < 16.4.7, 16.5.0-rc-1 < 16.10.3, 17.0.0-rc-1 < 17.0.0 Information Disclosure Vulnerability (GHSA-mvp5-qx9c-c3fv)

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:xwiki:xwiki";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.124855");
  script_version("2026-06-25T06:55:31+0000");
  script_tag(name:"last_modification", value:"2026-06-25 06:55:31 +0000 (Thu, 25 Jun 2026)");
  script_tag(name:"creation_date", value:"2025-07-18 05:10:52 +0000 (Fri, 18 Jul 2025)");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2025-06-13 18:15:22 +0000 (Fri, 13 Jun 2025)");

  script_cve_id("CVE-2025-49584");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("XWiki 10.9 < 16.4.7, 16.5.0-rc-1 < 16.10.3, 17.0.0-rc-1 < 17.0.0 Information Disclosure Vulnerability (GHSA-mvp5-qx9c-c3fv)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_xwiki_http_detect.nasl");
  script_mandatory_keys("xwiki/detected");

  script_tag(name:"summary", value:"Xwiki is prone to an information disclosure
  vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The title of every single page whose reference is known can be
  accessed through the REST API as long as an XClass with a page property is accessible, this is
  the default for an XWiki installation. This allows an attacker to get titles of pages whose
  reference is known, one title per request. This doesn't affect fully private wikis as the REST
  endpoint checks access rights on the XClass definition.");

  script_tag(name:"affected", value:"XWiki version 10.9 prior to 16.4.7, 16.5.0-rc-1 prior
  to 16.10.3 and 17.0.0-rc-1 prior to 17.0.0.");

  script_tag(name:"solution", value:"Update to version 16.4.7, 16.10.3, 17.0.0 or later.");

  script_xref(name:"URL", value:"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mvp5-qx9c-c3fv");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if( ! port = get_app_port( cpe:CPE ) )
  exit( 0 );

if ( ! infos = get_app_version_and_location( cpe:CPE, port:port, exit_no_version:TRUE ) )
  exit( 0 );

version = infos["version"];
location = infos["location"];

if( version_in_range_exclusive( version:version, test_version_lo:"10.9", test_version_up:"16.4.7" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"16.4.7", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"16.5.0-rc-1", test_version_up:"16.10.3" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"16.10.3", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"17.0.0-rc-1", test_version_up:"17.0.0" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"17.0.0", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

exit( 99 );