CVE-2025-49582: XWiki's required right warnings for macros are incomplete
8.6
CVSS Score
4.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.52786%
CWE
Published
6/13/2025
Updated
6/13/2025
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-rendering-xwiki | maven | >= 15.9-rc-1, < 16.4.7 | 16.4.7 |
| org.xwiki.platform:xwiki-platform-rendering-xwiki | maven | >= 16.5.0-rc-1, < 16.10.3 | 16.10.3 |
| org.xwiki.platform:xwiki-platform-rendering-xwiki | maven | >= 17.0.0-rc-1, < 17.0.0 | 17.0.0 |
| org.xwiki.platform:xwiki-platform-rendering-macro-cache | maven | >= 15.9-rc-1, < 16.4.7 | 16.4.7 |
| org.xwiki.platform:xwiki-platform-rendering-macro-cache | maven | >= 16.5.0-rc-1, < 16.10.3 | 16.10.3 |
| org.xwiki.platform:xwiki-platform-rendering-macro-cache | maven | >= 17.0.0-rc-1, < 17.0.0 | 17.0.0 |
| org.xwiki.platform:xwiki-platform-security-requiredrights-default | maven | >= 15.9-rc-1, < 16.4.7 | 16.4.7 |
| org.xwiki.platform:xwiki-platform-security-requiredrights-default | maven | >= 16.5.0-rc-1, < 16.10.3 | 17.0.0 |
| org.xwiki.platform:xwiki-platform-security-requiredrights-default | maven | >= 17.0.0-rc-1, < 17.0.0 | 17.0.0 |
| org.xwiki.platform:xwiki-platform-rendering-macro-context | maven | >= 15.9-rc-1, < 16.4.7 | 16.4.7 |
| org.xwiki.platform:xwiki-platform-rendering-macro-context | maven | >= 16.5.0-rc-1, < 16.10.3 | 16.10.3 |
| org.xwiki.platform:xwiki-platform-rendering-macro-context | maven | >= 17.0.0-rc-1, < 17.0.0 | 17.0.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability lies in several XWiki macro rights analyzers having incomplete or flawed logic, allowing attackers to craft macro invocations that bypass proper rights warnings. This could lead to remote code execution if a privileged user edits a page containing such malicious macros.
The specific issues identified and patched were:
- Incomplete Parameter Analysis: The
DefaultMacroBlockRequiredRightAnalyzer.analyzeWithExceptionsmethod did not sufficiently analyze macro parameters that could themselves contain renderable XWiki syntax. Attackers could hide malicious content in such parameters. - Missing Analysis of 'source' Parameter: The
ContextMacroRequiredRightsAnalyzer.analyzemethod failed to analyze thesourceparameter of the context macro. This meant content referenced via this parameter (including script variables) was not checked for required rights. - Case-Sensitive Parameter Lookups: Several analyzers, including those for Cache, HTML, and Raw macros (
CacheMacroRequiredRightsAnalyzer.analyze,HTMLMacroRequiredRightsAnalyzer.analyze,RawMacroRequiredRightsAnalyzer.analyze), used case-sensitive methods to retrieve critical parameters (e.g., "id", "wiki", "clean", "syntax"). Attackers could use different casings for these parameter names (e.g., "ID", "Wiki") to evade analysis. - Missing Analyzer for 'content' Macro: The vulnerability description also mentions that the 'content' macro's 'source' parameter was not analyzed. This was addressed by adding a new analyzer (
ContentMacroRequiredRightsAnalyzer) in commit0a705e8e253cb871b804e25c53b2bde879c886bd. Since this was a missing component rather than a flawed existing function, its newly added functions are not listed as 'vulnerable' but as the fix.
The patches address these flaws by making parameter analysis more comprehensive, adding checks for previously uninspected parameters like 'source', and ensuring that parameter name lookups are case-insensitive. These changes aim to make the rights warnings more robust and prevent attackers from hiding malicious macro content.