CVE-2025-58049

Katalog CVE

CVSS 7.5 · High EPSS 0,37%

Kerentanan Improper Removal of Sensitive Information Before Storage or Transfer pada xwiki. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies unencrypted in job statuses. XWiki shouldn't store passwords in plain text, and it shouldn't be possible to gain access to plain text passwords by gaining access to, e.g., a backup of the data directory. This vulnerability has been patched in XWiki 16.4.8, 16.10.7, and 17.4.0-rc-1.

Rincian

Terbit di NVD

28 Agustus 2025

Terakhir diubah

26 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
CWE-257: Storing Passwords in a Recoverable Format

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9m7c-m33f-3429 advisory vendor
• https://jira.xwiki.org/browse/XWIKI-23151 exploit · issue tracking · advisory vendor
• https://github.com/xwiki/xwiki-platform/commit/60982ad0057b1701ed8297f28cad35d170686539 patch