{"action":"Upgrade org.xwiki.platform:xwiki-platform-legacy-oldcore to 16.4.7 (16.4.x), 16.10.5 (16.10.x) or 17.2.0-rc-1 (17.2.x) or later.","affected":[{"fixed":"16.4.7","introduced":"9.8-rc-1"},{"fixed":"16.10.5","introduced":"16.5.0-rc-1"},{"fixed":"17.2.0-rc-1","introduced":"17.0.0-rc-1"}],"component":"org.xwiki.platform:xwiki-platform-legacy-oldcore","cve_ids":["CVE-2025-54124"],"ecosystem":"Maven","epss":0.00481,"exploited":false,"fixed_versions":["16.4.7","16.10.5","17.2.0-rc-1"],"ghsa_id":"GHSA-r38m-cgpg-qj69","id":"tcs_01M5N9ASTMCGFQHRPZSKGPM1AX","modified_at":"2025-08-06T14:31:18Z","published_at":"2025-08-05T17:12:03Z","references":["https://osv.dev/vulnerability/GHSA-r38m-cgpg-qj69","https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r38m-cgpg-qj69","https://nvd.nist.gov/vuln/detail/CVE-2025-54124","https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24","https://github.com/xwiki/xwiki-platform","https://jira.xwiki.org/browse/XWIKI-22811"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-r38m-cgpg-qj69#Maven/org.xwiki.platform:xwiki-platform-legacy-oldcore","url":"https://osv.dev/vulnerability/GHSA-r38m-cgpg-qj69"},{"source":"nvd","source_id":"CVE-2025-54124","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54124"}],"summary":"XWiki leaks password hashes and other accessible password properties"}