« Volver al listado

CVE-2025-53836

Estado: AnalizadaAlta (8.8)—

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 4.2-milestone-1 and prior to versions 13.10.11, 14.4.7, and 14.10, the default macro content parser doesn't preserve the restricted attribute of the transformation context when executing nested macros. This allows executing macros that are normally forbidden in restricted mode, in particular script macros. The cache and chart macros that are bundled in XWiki use the vulnerable feature.

Leer descripción completaMostrar menos

This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. To avoid the exploitation of this bug, comments can be disabled for untrusted users until an upgrade to a patched version has been performed. Note that users with edit rights will still be able to add comments via the object editor even if comments have been disabled.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso en red con PR:L permite ejecutar macros script prohibidos en modo restringido; la vulnerabilidad en el contexto de transformación anidada permite ejecución de código y elevación de privilegios.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementDisable or Remove Feature or ProgramApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser Training

Tecnologías afectadas (1)

Xwiki — Xwiki

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-53836",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-53836",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-15T13:24:52.433487Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "xwiki",
          "product": "xwiki-rendering",
          "versions": [
            {
              "status": "affected",
              "version": ">= 4.2-milestone-1, < 13.10.11"
            },
            {
              "status": "affected",
              "version": ">= 14.0, < 14.4.7"
            },
            {
              "status": "affected",
              "version": ">= 14.5, < 14.10"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-07-15T00:15:22.370",
  "references": [
    {
      "url": "https://github.com/xwiki/xwiki-rendering/commit/c73fa3ccd4ac59057e48e5d4325f659e78e8f86d",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-32mf-57h2-64x9",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://jira.xwiki.org/browse/XRENDERING-689",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://jira.xwiki.org/browse/XWIKI-20375",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-32mf-57h2-64x9",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 4.2-milestone-1 and prior to versions 13.10.11, 14.4.7, and 14.10, the default macro content parser doesn't preserve the restricted attribute of the transformation context when executing nested macros. This allows executing macros that are normally forbidden in restricted mode, in particular script macros. The cache and chart macros that are bundled in XWiki use the vulnerable feature. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. To avoid the exploitation of this bug, comments can be disabled for untrusted users until an upgrade to a patched version has been performed. Note that users with edit rights will still be able to add comments via the object editor even if comments have been disabled."
    },
    {
      "lang": "es",
      "value": "XWiki Rendering es un sistema de renderizado genérico que convierte la entrada textual en una sintaxis dada (sintaxis wiki, HTML, etc.) en otra sintaxis (XHTML, etc.). A partir de la versión 4.2-milestone-1 y anteriores a las versiones 13.10.11, 14.4.7 y 14.10, el analizador de contenido de macros predeterminado no conserva el atributo restringido del contexto de transformación al ejecutar macros anidadas. Esto permite ejecutar macros que normalmente están prohibidas en modo restringido, en particular las macros de script. Las macros de caché y gráficos incluidas en XWiki utilizan esta función vulnerable. Esto se ha corregido en XWiki 13.10.11, 14.4.7 y 14.10. Para evitar que se aproveche este fallo, se pueden desactivar los comentarios para usuarios no confiables hasta que se actualice a una versión corregida. Tenga en cuenta que los usuarios con permisos de edición podrán añadir comentarios a través del editor de objetos, incluso si los comentarios se han desactivado."
    }
  ],
  "lastModified": "2026-06-17T09:39:00.340",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E92E140-D0A7-4CBD-AD0A-96B49A0C5320",
              "versionEndExcluding": "13.10.11",
              "versionStartIncluding": "4.3"
            },
            {
              "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA3A5151-58FB-48CF-BFFB-5688608200C8",
              "versionEndExcluding": "14.4.7",
              "versionStartIncluding": "14.0"
            },
            {
              "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "569EE28C-5C86-467F-A153-DD4B9BF0053D",
              "versionEndExcluding": "14.10",
              "versionStartIncluding": "14.5"
            },
            {
              "criteria": "cpe:2.3:a:xwiki:xwiki:4.2:milestone1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "61814CC0-5C6A-469F-8436-F39577949E04"
            },
            {
              "criteria": "cpe:2.3:a:xwiki:xwiki:4.2:milestone2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFC3527D-024A-47A6-9684-C37B9CF3AC76"
            },
            {
              "criteria": "cpe:2.3:a:xwiki:xwiki:4.2:milestone3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC907C33-432E-4153-B1A2-9B8BF9167E1B"
            },
            {
              "criteria": "cpe:2.3:a:xwiki:xwiki:4.2:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EFF3A761-5E8B-447D-94D8-04895755876C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}