VYPR
Critical severityNVD Advisory· Published Apr 30, 2025· Updated Apr 30, 2025

org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right

CVE-2025-32973

Description

XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, when a user with programming rights edits a document in XWiki that was last edited by a user without programming rights and contains an XWiki.ComponentClass, there is no warning that this will grant programming rights to this object. An attacker who created such a malicious object could use this to gain programming rights on the wiki. For this, the attacker needs to have edit rights on at least one page to place this object and then get an admin user to edit that document. This issue has been patched in versions 15.10.12, 16.4.3, and 16.8.0-rc-1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.xwiki.platform:xwiki-platform-component-wikiMaven
>= 15.9-rc-1, < 15.10.1215.10.12
org.xwiki.platform:xwiki-platform-component-wikiMaven
>= 16.0.0-rc-1, < 16.4.316.4.3
org.xwiki.platform:xwiki-platform-component-wikiMaven
>= 16.5.0-rc-1, < 16.8.0-rc-116.8.0-rc-1

Affected products

1

Patches

1
1a6f1b2e0507

XWIKI-22460: XWiki.ComponentClass is missing a required rights analyzer

https://github.com/xwiki/xwiki-platformMichael HamannAug 29, 2024via ghsa
4 files changed · +123 0
  • xwiki-platform-core/xwiki-platform-component/xwiki-platform-component-wiki/pom.xml+5 0 modified
    @@ -73,6 +73,11 @@
           <artifactId>xwiki-platform-rendering-async-default</artifactId>
           <version>${project.version}</version>
         </dependency>
    +    <dependency>
    +      <groupId>org.xwiki.platform</groupId>
    +      <artifactId>xwiki-platform-security-requiredrights-api</artifactId>
    +      <version>${project.version}</version>
    +    </dependency>
     
         <!-- Test Dependencies -->
         <dependency>
    
  • xwiki-platform-core/xwiki-platform-component/xwiki-platform-component-wiki/src/main/java/org/xwiki/component/wiki/internal/WikiComponentRequiredRightAnalyzer.java+65 0 added
    @@ -0,0 +1,65 @@
    +/*
    + * See the NOTICE file distributed with this work for additional
    + * information regarding copyright ownership.
    + *
    + * This is free software; you can redistribute it and/or modify it
    + * under the terms of the GNU Lesser General Public License as
    + * published by the Free Software Foundation; either version 2.1 of
    + * the License, or (at your option) any later version.
    + *
    + * This software is distributed in the hope that it will be useful,
    + * but WITHOUT ANY WARRANTY; without even the implied warranty of
    + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    + * Lesser General Public License for more details.
    + *
    + * You should have received a copy of the GNU Lesser General Public
    + * License along with this software; if not, write to the Free
    + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    + * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    + */
    +package org.xwiki.component.wiki.internal;
    +
    +import java.util.List;
    +
    +import javax.inject.Inject;
    +import javax.inject.Named;
    +import javax.inject.Singleton;
    +
    +import org.xwiki.component.annotation.Component;
    +import org.xwiki.platform.security.requiredrights.RequiredRight;
    +import org.xwiki.platform.security.requiredrights.RequiredRightAnalysisResult;
    +import org.xwiki.platform.security.requiredrights.RequiredRightAnalyzer;
    +import org.xwiki.platform.security.requiredrights.RequiredRightsException;
    +import org.xwiki.platform.security.requiredrights.display.BlockSupplierProvider;
    +
    +import com.xpn.xwiki.objects.BaseObject;
    +
    +/**
    + * A {@link RequiredRightAnalyzer} for wiki component XObjects.
    + *
    + * @since 15.10.12
    + * @since 16.4.3
    + * @since 16.8.0RC1
    + * @version $Id$
    + */
    +@Component
    +@Singleton
    +@Named("XWiki.ComponentClass")
    +public class WikiComponentRequiredRightAnalyzer implements RequiredRightAnalyzer<BaseObject>
    +{
    +    @Inject
    +    @Named("translation")
    +    private BlockSupplierProvider<String> translationMessageSupplierProvider;
    +
    +    @Inject
    +    private BlockSupplierProvider<BaseObject> objectBlockSupplierProvider;
    +
    +    @Override
    +    public List<RequiredRightAnalysisResult> analyze(BaseObject object) throws RequiredRightsException
    +    {
    +        return List.of(new RequiredRightAnalysisResult(object.getReference(),
    +            this.translationMessageSupplierProvider.get("platform.component.wiki.programmingRightRequiredMessage"),
    +            this.objectBlockSupplierProvider.get(object),
    +            List.of(RequiredRight.PROGRAM)));
    +    }
    +}
    
  • xwiki-platform-core/xwiki-platform-component/xwiki-platform-component-wiki/src/main/resources/ApplicationResources.properties+52 0 added
    @@ -0,0 +1,52 @@
    +# ---------------------------------------------------------------------------
    +# See the NOTICE file distributed with this work for additional
    +# information regarding copyright ownership.
    +#
    +# This is free software; you can redistribute it and/or modify it
    +# under the terms of the GNU Lesser General Public License as
    +# published by the Free Software Foundation; either version 2.1 of
    +# the License, or (at your option) any later version.
    +#
    +# This software is distributed in the hope that it will be useful,
    +# but WITHOUT ANY WARRANTY; without even the implied warranty of
    +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    +# Lesser General Public License for more details.
    +#
    +# You should have received a copy of the GNU Lesser General Public
    +# License along with this software; if not, write to the Free
    +# Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    +# 02110-1301 USA, or see the FSF site: http://www.fsf.org.
    +# ---------------------------------------------------------------------------
    +
    +###############################################################################
    +# Wiki Component localization
    +#
    +# This contains the translations of the module in the default language
    +# (generally English).
    +#
    +# Translation key syntax:
    +#   <short top level project name>.<short module name>.<propertyName>
    +#   where:
    +#   * <short top level project name> = top level project name without the "xwiki-" prefix,
    +#                                     for example: commons, rendering, platform, enterprise, manager, etc
    +#   * <short module name> = the name of the Maven module without the <short top level project name> prefix,
    +#                           for example: oldcore, scheduler, activitystream, etc
    +#   * <propertyName> = the name of the property using camel case,
    +#                      for example updateJobClassCommitComment
    +#
    +# Comments: it's possible to add some detail about a key to make easier to
    +#   translate it by adding a comment before it. To make sure a comment is not
    +#   assigned to the following key use at least three sharps (###) for the comment
    +#   or after it.
    +#
    +# Deprecated keys:
    +#   * when deleting a key it should be moved to deprecated section at the end
    +#     of the file (between #@deprecatedstart and #@deprecatedend) and associated to the
    +#     first version in which it started to be deprecated
    +#   * when renaming a key, it should be moved to the same deprecated section
    +#     and a comment should be added with the following syntax:
    +#     #@deprecated new.key.name
    +#     old.key.name=Some translation
    +###############################################################################
    +
    +platform.component.wiki.programmingRightRequiredMessage=Registering wiki components requires programming rights
    
  • xwiki-platform-core/xwiki-platform-component/xwiki-platform-component-wiki/src/main/resources/META-INF/components.txt+1 0 modified
    @@ -8,6 +8,7 @@ org.xwiki.component.wiki.internal.DefaultWikiComponentManagerContext
     org.xwiki.component.wiki.internal.DefaultWikiComponentManagerEventListener
     org.xwiki.component.wiki.internal.DefaultWikiComponentMethodExecutor
     org.xwiki.component.wiki.internal.WikiComponentManagerEventListenerHelper
    +org.xwiki.component.wiki.internal.WikiComponentRequiredRightAnalyzer
     org.xwiki.component.wiki.internal.bridge.DefaultContentParser
     org.xwiki.component.wiki.internal.bridge.DefaultWikiComponentBridge
     org.xwiki.component.wiki.internal.bridge.DefaultWikiObjectComponentManagerEventListener
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.