org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type

The impact of CVE-2025-32974 is severe. An attacker can leverage this vulnerability to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to a wide range of malicious activities, including session hijacking, credential theft, defacement of the XWiki instance, and redirection to malicious websites. The ability to inject scripts into properties that are executed upon editing allows for persistent and stealthy attacks, as the malicious code remains embedded within the page until it is removed. The vulnerability bypasses existing XWiki warnings related to script macros, making it easier for attackers to exploit. Successful exploitation could compromise the entire XWiki installation and potentially affect connected systems.

Organizations heavily reliant on XWiki Platform for content management and collaboration are at significant risk. Specifically, deployments with a large number of users with elevated privileges (script, admin, or programming rights) are particularly vulnerable. Environments where users frequently edit pages containing properties are also at increased risk.

• linux / server:

journalctl -u xwiki -f | grep -i "script injection"

• generic web:

curl -I <xwiki_url>/xwiki/bin/view/Main/MainPage | grep -i "Content-Security-Policy"

• database (mysql):

SELECT property_name, property_value FROM xwiki_property WHERE property_value LIKE '%<script%'

1. 2025-04-29Disclosure

   disclosure

1. Reserviert2025-04-14
2. Veröffentlicht2025-04-29
3. Geändert2025-04-30
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-32974 is to upgrade XWiki Platform to version 15.10.8 or later. If upgrading immediately is not feasible, consider implementing temporary workarounds. Carefully review all page properties for suspicious content, particularly those related to text areas or properties that might accept script-like input. Restrict user permissions to the minimum necessary level; avoid granting script, admin, or programming rights to users who do not require them. Implement a Web Application Firewall (WAF) with rules to detect and block XSS payloads targeting XWiki. Monitor XWiki logs for unusual activity or attempts to inject malicious scripts. After upgrading, confirm the fix by attempting to create a page with a malicious script in a TextArea property and verifying that the script is not executed when a user with appropriate permissions edits the page.