CVE-2025-32970

Katalog CVE

CVSS 6.1 · Medium EPSS 0,59%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada xwiki. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

XWiki is a generic wiki platform. In versions starting from 13.5-rc-1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0, an open redirect vulnerability in the HTML conversion request filter allows attackers to construct URLs on an XWiki instance that redirects to any URL. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0.

Rincian

Terbit di NVD

30 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pjhg-9wr9-rj96 advisory vendor
• https://jira.xwiki.org/browse/XWIKI-22487 exploit · issue tracking · advisory vendor
• https://github.com/xwiki/xwiki-platform/commit/6dab7909f45deb00efd36a0cd47788e95ad64802 patch