N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-54125

CVE-2025-54125: XWiki exposes passwords and emails stored in fields not named password/email in xml.vm

Impact

The XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending ?xpage=xml to the URL includes password and email properties stored on a document that aren't named password or email. This allows any user to obtain the salted and hashed user account validation or password reset token. As those tokens are randomly generated strings, the immediate impact of this should be low. The user's password and email itself aren't exposed as those fields are named password and email and thus aren't affected. However, depending on how the wiki is used, there could be extensions or custom code that store passwords in plain text in such password properties that would be exposed by this vulnerability.

Patches

This vulnerability has been fixed by completely removing the output of password and email fields in this XML export in versions 17.2.0 RC1, 16.10.5 and 16.4.7.

Workarounds

If this XML export isn't needed, the file templates/xml.vm in the deployed WAR can be deleted. There isn't any feature in XWiki itself that depends on this XML export.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-54125

CVE-2025-54125:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.xwiki.platform:xwiki-platform-oldcore	maven	>= 1.1, < 16.4.7	16.4.7
org.xwiki.platform:xwiki-platform-oldcore	maven	>= 16.5.0-rc-1, < 16.10.5	16.10.5
org.xwiki.platform:xwiki-platform-oldcore	maven	>= 17.0.0-rc-1, < 17.2.0-rc-1	17.2.0-rc-1
org.xwiki.platform:xwiki-platform-legacy-oldcore	maven	>= 1.1, < 16.4.7	16.4.7
org.xwiki.platform:xwiki-platform-legacy-oldcore	maven	>= 16.5.0-rc-1, < 16.10.5	16.10.5
org.xwiki.platform:xwiki-platform-legacy-oldcore	maven	>= 17.0.0-rc-1, < 17.2.0-rc-1	17.2.0-rc-1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the XML export feature of XWiki, which can be triggered by appending ?xpage=xml to a document URL. The root cause is an incomplete redaction mechanism for sensitive data. The analysis of the patch commit 742ee3482ef6c2bd4ad03d0de9cdd81d0e8f3d59 reveals the core of the issue.

The primary vulnerable function is com.xpn.xwiki.api.Document.getXMLContent(). Its pre-patch implementation relied on regular expressions to find and replace the content of fields named password and email. This approach is flawed because XWiki allows creating properties of type 'Password' or 'Email' with arbitrary names. If a user created a password field named 'secret', its value would be exposed in the XML export.

The patch addresses this by introducing a more robust, type-based filtering system. A new property, excludedPropertyTypes, was added to DocumentInstanceInputProperties to carry a set of property types to be excluded from serialization. The getXMLContent function was refactored to use this new system, explicitly requesting the exclusion of 'Password' and 'Email' types.

The actual filtering logic was implemented in com.xpn.xwiki.internal.filter.input.BaseObjectEventGenerator.write(). This function, which is called during the XML serialization process, was modified to check each property's type against the excludedPropertyTypes list. If a match is found, the property is skipped, effectively preventing its inclusion in the final XML output.

Therefore, an exploit would involve a user with view rights accessing a crafted URL, which would invoke com.xpn.xwiki.api.Document.getXMLContent(). In a vulnerable version, this would lead to the serialization process, including the BaseObjectEventGenerator.write method, writing sensitive data to the output because the necessary type checks were absent.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.