CVE-2025-54124: high-severity vulnerability in xwiki-platform
XWiki Platform: Any user with editing rights can access password properties through Database List Properties
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.5%
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 9.8-rc-1 through 16.4.6, 16.5.0-rc-1 through 16.10.4, and 17.0.0-rc-1 through 17.1.0, any user with editing rights can create an XClass with a database list property that references a password property. When adding an object of that XClass, the content of that password property is displayed. In practice, with a standard rights setup, this means that any user with an account on the wiki can access password hashes of all users, and possibly other password properties (with hashed or plain storage) that are on pages that the user can view. This issue is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
xwiki · xwiki-platformRelated CVEs — xwiki-platform
In the same product, most dangerous first.
CVE-2025-24893CRITICALRemote code execution as guest via SolrSearchMacros request in xwikiEPSS 100.0%KEVCVE-2024-21650CRITICALXWiki Remote Code Execution vulnerability via user registrationEPSS 93.5%CVE-2023-37462CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-uiEPSS 91.6%CVE-2023-46731CRITICALRemote code execution through the section parameter in Administration as guest in XWiki PlatformEPSS 88.5%CVE-2025-32429CRITICALXWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterEPSS 85.5%CVE-2023-50719HIGHXWiki Platform Solr search discloses password hashes of all usersEPSS 83.5%