CVE-2025-29925
1 advisory.
Maven/org.xwiki.platform:xwiki-platform-rest-server CVE-2025-29925: medium 5.3, EPSS 0.95%
XWiki allows unregistered users to access private pages information through REST endpoint
Action: Upgrade org.xwiki.platform:xwiki-platform-rest-server to 15.10.14 (15.10.x), 16.4.6 (16.4.x) or 16.10.0-rc-1 (16.10.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.9M1 | 15.10.14 | - |
| 16.0.0-rc-1 | 16.4.6 | - |
| 16.5.0-rc-1 | 16.10.0-rc-1 | - |
Fixed versions
| 15.10.14 | 16.4.6 | 16.10.0-rc-1 |
Sources
- osv: GHSA-22q5-9phm-744v
- nvd: CVE-2025-29925
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-22q5-9phm-744v
- https://github.com/xwiki/xwiki-platform/commit/1fb12d2780f37b34a1b4dfdf8457d97ce5cbb2df
- https://github.com/xwiki/xwiki-platform/commit/bca72f5ce971a31dba2a016d8dd8badda4475206
- https://github.com/xwiki/xwiki-platform
- https://jira.xwiki.org/browse/XWIKI-22630
- https://jira.xwiki.org/browse/XWIKI-22639
CVE-2025-29925 · published · modified · JSON