Lookup for vulnerabilities affecting packages.
| Vulnerability_id | VCID-4n2t-crsf-87gr |
|---|
| Summary | XWiki allows remote code execution through preview of XClass changes in AWM editor
### Impact
Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki) can obtain programming right/perform remote code execution by editing the application. The detailed reproduction steps can be found in the [original bug report](https://jira.xwiki.org/browse/XWIKI-22719).
### Patches
This vulnerability has been fixed in XWiki 17.0.0, 16.4.7, and 16.10.3.
### Workarounds
Restricting edit rights on all existing App Within Minutes applications to trusted users mitigates at least the PoC exploit, but we can't exclude that there are other ways to exploit this vulnerability. |
|---|
| Aliases |
| 0 |
|
| 1 |
| alias |
GHSA-jp4x-w9cj-97q7 |
|
|
|---|
| Fixed_packages |
|
|---|
| Affected_packages |
|
|---|
| References |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2025-49586 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.04551 |
| scoring_system |
epss |
| scoring_elements |
0.89162 |
| published_at |
2026-04-04T12:55:00Z |
|
| 1 |
| value |
0.04551 |
| scoring_system |
epss |
| scoring_elements |
0.89147 |
| published_at |
2026-04-02T12:55:00Z |
|
| 2 |
| value |
0.04551 |
| scoring_system |
epss |
| scoring_elements |
0.89182 |
| published_at |
2026-04-08T12:55:00Z |
|
| 3 |
| value |
0.04551 |
| scoring_system |
epss |
| scoring_elements |
0.89165 |
| published_at |
2026-04-07T12:55:00Z |
|
| 4 |
| value |
0.09249 |
| scoring_system |
epss |
| scoring_elements |
0.92725 |
| published_at |
2026-04-13T12:55:00Z |
|
| 5 |
| value |
0.09249 |
| scoring_system |
epss |
| scoring_elements |
0.9272 |
| published_at |
2026-04-09T12:55:00Z |
|
| 6 |
| value |
0.09249 |
| scoring_system |
epss |
| scoring_elements |
0.92726 |
| published_at |
2026-04-11T12:55:00Z |
|
| 7 |
| value |
0.09249 |
| scoring_system |
epss |
| scoring_elements |
0.92743 |
| published_at |
2026-04-24T12:55:00Z |
|
| 8 |
| value |
0.09249 |
| scoring_system |
epss |
| scoring_elements |
0.9274 |
| published_at |
2026-04-21T12:55:00Z |
|
| 9 |
| value |
0.09249 |
| scoring_system |
epss |
| scoring_elements |
0.92736 |
| published_at |
2026-04-18T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2025-49586 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
| reference_url |
https://jira.xwiki.org/browse/XWIKI-22719 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 1 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 2 |
| value |
Track* |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-06-13T18:07:25Z/ |
|
|
| url |
https://jira.xwiki.org/browse/XWIKI-22719 |
|
| 5 |
|
| 6 |
|
|
|---|
| Weaknesses |
| 0 |
| cwe_id |
863 |
| name |
Incorrect Authorization |
| description |
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. |
|
| 1 |
| cwe_id |
937 |
| name |
OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities |
| description |
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013. |
|
| 2 |
| cwe_id |
1035 |
| name |
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| description |
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017. |
|
|
|---|
| Exploits |
|
|---|
| Severity_range_score | 7.0 - 8.9 |
|---|
| Exploitability | 0.5 |
|---|
| Weighted_severity | 8.0 |
|---|
| Risk_score | 4.0 |
|---|
| Resource_url | http://public2.vulnerablecode.io/vulnerabilities/VCID-4n2t-crsf-87gr |
|---|