CVE-2025-49584— XWiki makes title of inaccessible pages available through the class property values REST API
Quick assessment
Affected
xwiki xwiki-platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
XWiki Platform是XWiki开源的一套用于创建Web协作应用程序的Wiki平台。 XWiki Platform 10.9至16.4.6版本、16.5.0-rc-1至16.10.2版本和17.0.0-rc-1版本存在安全漏洞，该漏洞源于REST API可访问页面标题，可能导致信息泄露。
Possible ATT&CK Techniques 1 AI
T1115 · Clipboard Data
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-49584
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
XWiki makes title of inaccessible pages available through the class property values REST API
Source: CVE Program / CVE List V5
Vulnerability Description
XWiki is a generic wiki platform. In XWiki Platform versions 10.9 through 16.4.6, 16.5.0-rc-1 through 16.10.2, and 17.0.0-rc-1, the title of every single page whose reference is known can be accessed through the REST API as long as an XClass with a page property is accessible, this is the default for an XWiki installation. This allows an attacker to get titles of pages whose reference is known, one title per request. This doesn't affect fully private wikis as the REST endpoint checks access rights on the XClass definition. The impact on confidentiality depends on the strategy for page names. By default, page names match the title, so the impact should be low but if page names are intentionally obfuscated because the titles are sensitive, the impact could be high. This has been fixed in XWiki 16.4.7, 16.10.3 and 17.0.0 by adding access control checks before getting the title of any page.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过发送数据的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
XWiki Platform 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
XWiki Platform是XWiki开源的一套用于创建Web协作应用程序的Wiki平台。 XWiki Platform 10.9至16.4.6版本、16.5.0-rc-1至16.10.2版本和17.0.0-rc-1版本存在安全漏洞，该漏洞源于REST API可访问页面标题，可能导致信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| xwiki | xwiki-platform | >= 10.9, < 16.4.7 | - |
|
II. Public POCs for CVE-2025-49584
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-49584
请登录查看更多情报信息。
Same Patch Batch · xwiki · 2025-06-13 · 8 CVEs total
| CVE-2025-49587 | XWiki does not require right warnings for notification displayer objects | |
| CVE-2025-49586 | XWiki allows remote code execution through preview of XClass changes in AWM editor | |
| CVE-2025-49585 | XWiki does not require right warnings for XClass definitions | |
| CVE-2025-49583 | XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRenderer | |
| CVE-2025-49582 | XWiki's required right warnings for macros are incomplete | |
| CVE-2025-49581 | XWiki allows remote code execution through default value of wiki macro wiki-type parameter | |
| CVE-2025-49580 | XWiki allows privilege escalation through link refactoring |
IV. Related Vulnerabilities
Same product: xwiki-platform
-
CVE-2026-53966
XWiki Platform: Privilege escalation from edit to script rig -
CVE-2026-34151
XWiki Platform: Resource path traversal via /skin/ action en -
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin -
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin -
CVE-2026-33137
XWiki Platform has an Unauthenticated XAR Import via REST /w
Same vendor: xwiki
-
CVE-2025-53837
org.xwiki.rendering:xwiki-rendering-xml has an Eval Injectio -
CVE-2026-53966
XWiki Platform: Privilege escalation from edit to script rig -
CVE-2026-34151
XWiki Platform: Resource path traversal via /skin/ action en -
CVE-2026-48048
XWiki Platform's Livetable results still allow reconstructin -
CVE-2026-48047
XWiki Platform vulnerable to potential arbitrary file writin
Same weakness: CWE-201
-
CVE-2026-100258
JetBrains YouTrack 2026.2.18991前越权读取项目设置 -
CVE-2026-97302
WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vuln -
CVE-2026-97261
WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure v -
CVE-2026-97241
WordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposu -
CVE-2026-97240
WordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Da
V. Comments for CVE-2025-49584
No comments yet