CVE-2025-54124 - CVE House
Back to Database
Status published High CVE-2025-54124

XWiki Platform: Any user with editing rights can access password properties through Database List Properties

Vulnerability Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 9.8-rc-1 through 16.4.6, 16.5.0-rc-1 through 16.10.4, and 17.0.0-rc-1 through 17.1.0, any user with editing rights can create an XClass with a database list property that references a password property. When adding an object of that XClass, the content of that password property is displayed. In practice, with a standard rights setup, this means that any user with an account on the wiki can access password hashes of all users, and possibly other password properties (with hashed or plain storage) that are on pages that the user can view. This issue is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54124

Credits & Attribution

No credits recorded in the NVD database.

References

More from xwiki

View All →
CVE-2025-66474
XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection
High 8.7
CVE-2025-66473
XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis
High 8.7
CVE-2025-66472
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
Medium 6.5
CVE-2025-58049
XWiki PDF export jobs store sensitive cookies unencrypted in job statuses
Medium 5.8
CVE-2025-55749
The XWiki Jetty package (XJetty) allows accessing any application file through URL
High 8.7

Affected Vendor

Affected Software

xwiki-platform
Vulnerable Versions:
>= 9.8-rc-1, < 16.4.7, >= 16.5.0-rc-1, < 16.10.5, >= 17.0.0-rc-1, < 17.2.0-rc-1

Timeline

Official Publish: August 5th, 2025
Last Modified: August 6th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-359

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.