Listen to this Post
The vulnerability in XWiki occurs when exporting a page to XML via the `?xpage=xml` parameter. Any user with view rights can trigger this export, which inadvertently exposes password and email properties stored in fields not explicitly named “password” or “email.” The XML output includes salted hashes of user account validation and password reset tokens, which are randomly generated. While plaintext passwords and emails stored in properly named fields remain protected, custom implementations or extensions may store sensitive data in differently named fields, leading to unintended exposure. The issue is mitigated in patched versions by completely removing password and email field outputs from XML exports.
DailyCVE Form:
Platform: XWiki
Version: < 16.4.7, < 16.10.5, < 17.2.0-rc-1
Vulnerability: Information Disclosure
Severity: Medium
Date: Aug 5, 2025
Prediction: Patch expected Aug 12, 2025
What Undercode Say:
Analytics:
curl -s "http://xwiki/page?xpage=xml" | grep -E "password|email"
<!-- Example vulnerable XML output --> <property name="hidden_pass" value="salted_hash_here"/>
How Exploit:
1. Access vulnerable XWiki page.
2. Append `?xpage=xml` to URL.
3. Parse XML for exposed fields.
Protection from this CVE:
- Upgrade to 16.4.7/16.10.5/17.2.0-rc-1.
- Delete `templates/xml.vm` if unused.
Impact:
- Exposed password reset tokens.
- Potential plaintext leaks (custom fields).
- Low immediate risk (random tokens).
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
