CVE-2025-32429: xwiki — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2025-32429

CVSS 9.8 · Critical EPSS 87,1%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada xwiki. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.

Rincian

Terbit di NVD: 24 Juli 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
EPSS (30 hari): 87,1% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
xwiki	xwiki	Versi 9.4 hingga sebelum 16.10.6
xwiki	xwiki	Versi 17.0.0 hingga 17.2.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vr59-gm53-v7cq advisory vendor
https://jira.xwiki.org/browse/XWIKI-23093 issue tracking · advisory vendor
https://github.com/xwiki/xwiki-platform/commit/dfd0744e9c18d24ac66a0d261dc6cafd1c209101 patch
https://github.com/xwiki/xwiki-platform/commit/f502b5d5fd36284a50890ad26d168b7d8dc80bd3 patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.