CVE-2025-58049CWE-212CWE-257

CVE-2025-58049

Medium · published August 28, 2025

CVSS v3.1
5.8
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies unencrypted in job statuses. XWiki shouldn't store passwords in plain text, and it shouldn't be possible to gain access to plain text passwords by gaining access to, e.g., a backup of the data directory. This vulnerability has been patched in XWiki 16.4.8, 16.10.7, and 17.4.0-rc-1.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00365 · 29.2th percentile
Weaknesses
CWE-212 · Improper Removal of Sensitive Information Before Storage or Transfer; CWE-257 · Storing Passwords in a Recoverable Format
Published
2025-08-28T22:15Z
Affected products (3)
ProductVersionsFixed in
xwiki/xwiki≥ 14.4.2, < 16.4.816.4.8
xwiki/xwiki≥ 16.5.0, < 16.10.716.10.7
xwiki/xwiki≥ 17.0.0, ≤ 17.3.0—
References (3)
https://github.com/xwiki/xwiki-platform/commit/60982ad0057b1701ed8297f28cad35d170686539 · [email protected]https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9m7c-m33f-3429 · [email protected]https://jira.xwiki.org/browse/XWIKI-23151 · [email protected]
EPSS history
Timeline
  • 28 AUG 17:43Z
    XWiki PDF export jobs store sensitive cookies unencrypted in job statuses
    cvelistv5