XWiki 6.1-rc-1 < 15.10.14, 16.x < 16.4.6, 16.5.x < 16.10.0 Authorization Bypass Vulnerability (GHSA-gq32-758c-3wm3)

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:xwiki:xwiki";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.128113");
  script_version("2026-01-29T08:35:42+0000");
  script_tag(name:"last_modification", value:"2026-01-29 08:35:42 +0000 (Thu, 29 Jan 2026)");
  script_tag(name:"creation_date", value:"2025-04-01 12:10:52 +0000 (Tue, 01 Apr 2025)");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2025-04-30 15:58:41 +0000 (Wed, 30 Apr 2025)");

  script_cve_id("CVE-2025-29924");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("XWiki 6.1-rc-1 < 15.10.14, 16.x < 16.4.6, 16.5.x < 16.10.0 Authorization Bypass Vulnerability (GHSA-gq32-758c-3wm3)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_xwiki_http_detect.nasl");
  script_mandatory_keys("xwiki/detected");

  script_tag(name:"summary", value:"Xwiki is prone to an authorization bypass vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The vulnerability in sub wiki allows users to access private
  information through the REST API when 'Prevent unregistered users to view pages' or 'Prevent
  unregistered users to edit pages' is enabled.");

  script_tag(name:"affected", value:"XWiki version 6.1-rc-1 prior to 15.10.14, 16.x prior to 16.4.6
  and 16.5.x prior to 16.10.0.");

  script_tag(name:"solution", value:"Update to versions 15.10.14, 16.4.6, 16.10.0 or later.");

  script_xref(name:"URL", value:"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gq32-758c-3wm3");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if( ! port = get_app_port( cpe:CPE ) )
  exit( 0 );

if ( ! infos = get_app_version_and_location( cpe:CPE, port:port, exit_no_version:TRUE ) )
  exit( 0 );

version = infos["version"];
location = infos["location"];

if( version_in_range_exclusive( version:version, test_version_lo:"6.1-rc-1", test_version_up:"15.10.14" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"15.10.14", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"16.0.0", test_version_up:"16.4.6" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"16.4.6", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"16.5.0", test_version_up:"16.10.0" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"16.10.0", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}


exit( 99 );