CVE-2025-23025

Estado: AnalizadaAlta (8)—

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. NOTE: The Realtime WYSIWYG Editor extension was **experimental**, and thus **not recommended**, in the versions affected by this vulnerability. It has become enabled by default, and thus recommended, starting with XWiki 16.9.0. A user with only **edit right** can join a realtime editing session where others, that where already there or that may join later, have **script** or **programming** access rights.

Leer descripción completaMostrar menos

This user can then insert **script rendering macros** that are executed for those users in the realtime session that have script or programming rights. The inserted scripts can be used to gain more access rights. This vulnerability has been patched in XWiki 15.10.2, 16.4.1 and 16.6.0-rc-1. Users are advised to upgrade. Users unable to upgrade may either disable the realtime WYSIWYG editing by disabling the ``xwiki-realtime`` CKEditor plugin from the WYSIWYG editor administration section or uninstall the Realtime WYSIWYG Editorextension (org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui).

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Puntuación base: 8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.41%
Percentil entre todas las CVEs puntuadas: 33
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1203 Exploitation for Client Executionexecution85 %
Impacto principalT1078 Valid Accountsstealth · persistence · privilege escalation · initial access80 %
Impacto secundarioT1059 Command and Scripting Interpreterexecution75 %

Requiere interacción del usuario (UI:R) y acceso local al editor WYSIWYG (usuario con edit right) para insertar macros; el atacante ejecuta scripts en sesiones de otros usuarios con privilegios elevados para elevar sus propios derechos (CWE-862: autorización incorrecta).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Application Developer Guidance Active Directory Configuration User Training User Account Management Restrict Web-Based Content

Tecnologías afectadas (1)

Xwiki — Xwiki

CWE

CWE-862

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-23025",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-23025",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-15T15:29:51.884454Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "xwiki",
          "product": "xwiki-platform",
          "versions": [
            {
              "status": "affected",
              "version": ">= 13.9-rc-1, < 15.10.12"
            },
            {
              "status": "affected",
              "version": ">= 16.0.0, < 16.4.1"
            },
            {
              "status": "affected",
              "version": ">= 16.5.0, < 16.6.0-rc-1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-01-14T18:16:05.650",
  "references": [
    {
      "url": "https://extensions.xwiki.org/xwiki/bin/view/Extension/CKEditor+Integration#HAdministrationSection",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://extensions.xwiki.org/xwiki/bin/view/Extension/Realtime%20WYSIWYG%20Editor",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rmm7-r7wr-xpfg",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://jira.xwiki.org/browse/XWIKI-21949",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. NOTE: The Realtime WYSIWYG Editor extension was **experimental**, and thus **not recommended**, in the versions affected by this vulnerability. It has become enabled by default, and thus recommended, starting with XWiki 16.9.0. A user with only **edit right** can join a realtime editing session where others, that where already there or that may join later, have **script** or **programming** access rights. This user can then insert **script rendering macros** that are executed for those users in the realtime session that have script or programming rights. The inserted scripts can be used to gain more access rights. This vulnerability has been patched in XWiki 15.10.2, 16.4.1 and 16.6.0-rc-1. Users are advised to upgrade. Users unable to upgrade may either disable the realtime WYSIWYG editing by disabling the ``xwiki-realtime`` CKEditor plugin from the WYSIWYG editor administration section or uninstall the Realtime WYSIWYG Editorextension (org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui)."
    },
    {
      "lang": "es",
      "value": "XWiki Platform es una plataforma wiki genérica que ofrece servicios de tiempo de ejecución para aplicaciones creado sobre ella. NOTA: La extensión Realtime WYSIWYG Editor era **experimental**, y por lo tanto **no recomendada**, en las versiones afectadas por esta vulnerabilidad. Se ha habilitado de forma predeterminada, y por lo tanto se recomienda, a partir de XWiki 16.9.0. Un usuario con solo **derecho de edición** puede unirse a una sesión de edición en tiempo real en la que otros, que ya estaban allí o que se unirán más tarde, tienen **derechos de acceso de MASK15**** o **programación**. Este usuario puede insertar Script macros de renderizado** que se ejecutan para esos usuarios en la sesión en tiempo real mediante el script MASK13** o los derechos de programación. Los Scripts insertados se pueden utilizar para obtener más derechos de acceso. Esta vulnerabilidad se ha corregido en XWiki 15.10.2, 16.4.1 y 16.6.0-rc-1. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden deshabilitar la edición WYSIWYG en tiempo real deshabilitando el complemento CKEditor ``xwiki-realtime`` desde la sección de administración del editor WYSIWYG o desinstalar la extensión Realtime WYSIWYG Editor (org.xwiki.platform:xwiki-platform-realtime-wysiwyg-ui)."
    }
  ],
  "lastModified": "2026-06-17T08:51:31.050",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDA63367-EB24-44E0-A50F-6C5AE08F4A3D",
              "versionEndExcluding": "15.10.12",
              "versionStartIncluding": "13.9"
            },
            {
              "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5921C493-2A56-49BC-8763-7D12518C0DC2",
              "versionEndExcluding": "16.4.1",
              "versionStartIncluding": "16.0.0"
            },
            {
              "criteria": "cpe:2.3:a:xwiki:xwiki:16.5.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E19BF5E-55B0-4587-971D-CD66E330B605"
            },
            {
              "criteria": "cpe:2.3:a:xwiki:xwiki:16.5.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F584366-586F-453C-8E5F-F252ECD0C815"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}