Listen to this Post
How the CVE Works
The vulnerability occurs when an authenticated user with edit rights creates an XClass with a database list property referencing a password property (e.g., stored password hashes). When an object of this XClass is added, the password property content is exposed. This allows any standard user to access password hashes of all users and other sensitive password-related data stored in viewable pages. The flaw stems from improper access control in database list property handling, enabling unintended data disclosure.
DailyCVE Form
Platform: XWiki
Version: 9.8-rc-1 to 16.4.6
Vulnerability: Hash leak
Severity: Critical
Date: Aug 5, 2025
Prediction: Patch by Aug 12, 2025
What Undercode Say
SELECT FROM XWikiUsers WHERE password_property_exposed = TRUE;
curl -X GET "http://xwiki-instance/XClass/leak"
How Exploit
1. Authenticate as a low-privilege user.
2. Create XClass with database list property.
3. Reference password property in list.
4. View exposed hashes via object insertion.
Protection from this CVE
- Upgrade to XWiki 16.4.7/16.10.5/17.2.0-rc-1.
- Disable password property references.
- Restrict edit rights.
Impact
- Full password hash exposure.
- Compromise of user accounts.
- Potential privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
