XWiki 15.9-rc-1 < 15.10.12, 16.0.0-rc-1 < 16.4.3, 16.5.0-rc-1 < 16.8.0 Privilege Escalation Vulnerability (GHSA-x7wv-5qg4-vmr6)

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:xwiki:xwiki";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.124863");
  script_version("2025-11-19T05:40:23+0000");
  script_tag(name:"last_modification", value:"2025-11-19 05:40:23 +0000 (Wed, 19 Nov 2025)");
  script_tag(name:"creation_date", value:"2025-07-18 05:10:52 +0000 (Fri, 18 Jul 2025)");
  script_tag(name:"cvss_base", value:"9.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2025-05-13 14:58:48 +0000 (Tue, 13 May 2025)");

  script_cve_id("CVE-2025-32973");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("XWiki 15.9-rc-1 < 15.10.12, 16.0.0-rc-1 < 16.4.3, 16.5.0-rc-1 < 16.8.0 Privilege Escalation Vulnerability (GHSA-x7wv-5qg4-vmr6)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Privilege escalation");
  script_dependencies("gb_xwiki_http_detect.nasl");
  script_mandatory_keys("xwiki/detected");

  script_tag(name:"summary", value:"Xwiki is prone to a privilege escalation
  vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"When a user with programming right edits a document in XWiki
  that was last edited by a user without programming right and contains an XWiki.ComponentClass,
  there is no warning that this will grant programming right to this object. An attacker who
  created such a malicious object could use this to gain programming right on the wiki. For this,
  the attacker needs to have edit right on at least one page to place this object and then get an
  admin user to edit that document.");

  script_tag(name:"affected", value:"XWiki version 15.9-rc-1 prior to 15.10.12, 16.0.0-rc-1 prior
  to 16.4.3 and 16.5.0-rc-1 prior to 16.8.0.");

  script_tag(name:"solution", value:"Update to version 15.10.12, 16.4.3, 16.8.0 or later.");

  script_xref(name:"URL", value:"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x7wv-5qg4-vmr6");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if( ! port = get_app_port( cpe:CPE ) )
  exit( 0 );

if ( ! infos = get_app_version_and_location( cpe:CPE, port:port, exit_no_version:TRUE ) )
  exit( 0 );

version = infos["version"];
location = infos["location"];

if( version_in_range_exclusive( version:version, test_version_lo:"15.9-rc-1", test_version_up:"15.10.12" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"15.10.12", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"16.0.0-rc-1", test_version_up:"16.4.3" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"16.4.3", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"16.5.0-rc-1", test_version_up:"16.8.0" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"16.8.0", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

exit( 99 );