{"id":"CVE-2025-32972","summary":"The lesscss script service allows cache clearing without programming right","details":"XWiki is a generic wiki platform. In versions starting from 6.1-milestone-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the script API of the LESS compiler in XWiki is incorrectly checking for rights when calling the cache cleaning API, making it possible to clean the cache without having programming right. The only impact of this is a slowdown in XWiki execution as the caches are re-filled. As this vulnerability requires script right to exploit, and script right already allows unlimited execution of scripts, the additional impact due to this vulnerability is low. This issue has been patched in versions 15.10.12, 16.4.3, and 16.8.0-rc-1.","aliases":["GHSA-rp38-24m3-rx87"],"modified":"2026-08-12T15:16:28.705882Z","published":"2025-04-30T14:54:58.945Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32972.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-285"]},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22462"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32972.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rp38-24m3-rx87"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32972"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"c7b2fe24e1384a01ffebb4feaf1566a8bbbde153"},{"fixed":"a75114d3e9875bc3383329fa44f9b47bf2871762"},{"introduced":"918ea43fe0d277c28efa21a871175b329c75157c"},{"fixed":"a74a28b426e394510b9cebcf261fc91853719acf"},{"introduced":"526fcc68b3f75862a2af7395b5a6dfdd3d2166a5"},{"fixed":"b7e6ace16af1a52758fb881837d1d05f6f51a418"},{"introduced":"e4fc52610e9a8fb76a5cbe2e1282077e5757d18f"},{"last_affected":"029f39adf510c8be3c4b6cf8b75ba1abdc622aee"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:6.1:-:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:6.1:milestone1:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:6.1:milestone2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.2"},{"fixed":"15.10.12"},{"introduced":"16.0.0"},{"fixed":"16.4.3"},{"introduced":"16.5.0"},{"fixed":"16.8.0"},{"introduced":"6.1-NA"},{"last_affected":"6.1-NA"},{"introduced":"6.1-milestone1"},{"last_affected":"6.1-milestone1"},{"introduced":"6.1-milestone2"},{"last_affected":"6.1-milestone2"}],"source":["CPE_RANGE","CPE_STRING"]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"c427b927d0904c5989881dbf21d3f486eb0bf4ed"},{"fixed":"6914819340c6e94b51b7e5c68613f47831d4996b"},{"introduced":"3c6f5cf138d8095f63631e554ba448e4b780e162"},{"fixed":"82ba90784232fd5947c70b74bbbcfc67a245aca1"},{"introduced":"177e524c2e218fe5de776619271b7cd12c929488"},{"fixed":"49af0ac677c5f80e29ec8044c81ac51d3161152a"},{"introduced":"9ef3ab7e28c42689836581232bf27ef84c15d80d"},{"fixed":"91752122d8782f171f8728004a57bdaefc34253e"}],"database_specific":{"cpe":["cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:6.1:-:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:6.1:milestone1:*:*:*:*:*:*","cpe:2.3:a:xwiki:xwiki:6.1:milestone2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.2"},{"fixed":"15.10.12"},{"introduced":"16.0.0"},{"fixed":"16.4.3"},{"introduced":"16.5.0"},{"fixed":"16.8.0"},{"introduced":"6.1-NA"},{"last_affected":"6.1-NA"},{"introduced":"6.1-milestone1"},{"last_affected":"6.1-milestone1"},{"introduced":"6.1-milestone2"},{"last_affected":"6.1-milestone2"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["6.1-NA","6.1-milestone1","6.1-milestone2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32972.json","vanir_signatures_modified":"2026-08-12T15:16:28Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e","target":{"file":"xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/test/java/org/xwiki/lesscss/LessCompilerScriptServiceTest.java","function":"clearCacheFromSkinWithRights"},"deprecated":false,"digest":{"function_hash":"35590578146992370760656817731770362413","length":722},"id":"CVE-2025-32972-175ad00c","signature_type":"Function"},{"target":{"file":"xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/test/java/org/xwiki/lesscss/LessCompilerScriptServiceTest.java","function":"clearCacheFromColorThemeWithRights"},"deprecated":false,"digest":{"function_hash":"90003973987172840059795540001675420323","length":740},"id":"CVE-2025-32972-52df2211","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e"},{"deprecated":false,"digest":{"function_hash":"82072351446255376812064518143874372063","length":560},"id":"CVE-2025-32972-681d47ff","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e","target":{"file":"xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/test/java/org/xwiki/lesscss/LessCompilerScriptServiceTest.java","function":"clearCacheWithoutRights"}},{"deprecated":false,"digest":{"function_hash":"320779907900395051694057517481811362083","length":431},"id":"CVE-2025-32972-79c8301b","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e","target":{"file":"xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/main/java/org/xwiki/lesscss/LessCompilerScriptService.java","function":"clearCacheFromSkin"}},{"id":"CVE-2025-32972-7c8765da","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e","target":{"file":"xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/main/java/org/xwiki/lesscss/LessCompilerScriptService.java","function":"clearCache"},"deprecated":false,"digest":{"function_hash":"331036458359052477026087195607800271695","length":294}},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e","target":{"file":"xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/main/java/org/xwiki/lesscss/LessCompilerScriptService.java"},"deprecated":false,"digest":{"line_hashes":["26354114674643914098251582149836110712","122847670437072630553813708767699808279","301330648091290856480467200251575557494","86948520880146597500638078515848682601","286473275462433612255082425437475686932","274352027171814714020433640641895897347","153476407581812448728379984577941774650","36748194502398627378493192014563423147","153650642303657305414645751234824221766","263752687113836107815150453966292684458","324861828093085968870195840319973273244","176680763033700629276087172620858050660","173940358028824358514941389478414562039","295981392241568271245851678409312877021","231635045086134250331591898615540716758","8598238072392787981035094254468975827","201160888845140050564852946208570043728","247551474549901120190500739959035903127","46328983190908827366560857761069965034","100843318339168826946141409620491459066","134530280904772884079572198308452398798","3014832254704088645877918123451933656","151608077193962395205570599271218733956","253636885997382931081066850782323165344","73804854254818670018083243962884070297","155527883425575336622186403424120640938","104015779212699421005483466368883451159","3014832254704088645877918123451933656","151608077193962395205570599271218733956","253636885997382931081066850782323165344","245113522653022835975415625012589107846","334878905600961254475810376464862369495","286681707528832347853776830604409278321","3014832254704088645877918123451933656","151608077193962395205570599271218733956","253636885997382931081066850782323165344","245113522653022835975415625012589107846"],"threshold":0.9},"id":"CVE-2025-32972-85592d7b","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e","target":{"file":"xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/main/java/org/xwiki/lesscss/LessCompilerScriptService.java","function":"clearCacheFromColorTheme"},"deprecated":false,"digest":{"function_hash":"24471483877104981484459232270747184483","length":437},"id":"CVE-2025-32972-94846df1"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e","target":{"function":"clearCacheFromColorThemeWithoutRights","file":"xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/test/java/org/xwiki/lesscss/LessCompilerScriptServiceTest.java"},"deprecated":false,"digest":{"function_hash":"243256167117571337895056020292673834625","length":573},"id":"CVE-2025-32972-b5d87ace","signature_type":"Function"},{"id":"CVE-2025-32972-c4738e91","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e","target":{"file":"xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/test/java/org/xwiki/lesscss/LessCompilerScriptServiceTest.java","function":"clearCacheWithRights"},"deprecated":false,"digest":{"function_hash":"47257735988333529455222790735845656460","length":589}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e","target":{"file":"xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/test/java/org/xwiki/lesscss/LessCompilerScriptServiceTest.java","function":"clearCacheFromSkinWithoutRights"},"deprecated":false,"digest":{"function_hash":"67495178266199656474776340267351627445","length":567},"id":"CVE-2025-32972-e6a954fd"},{"deprecated":false,"digest":{"line_hashes":["8530559662151459972565004054198710690","120867000324663890123402093787590803449","298360063325840311120890685337061460157","289849621706375707740750179983022806095","82438302340837852241171746182390400541","250463202435729184047226704144961056942","134141265639701617773075904164679762691","313857156246645670003548288670575606359","339741787043539873769506372889568992776","317271996167258544138831681519695054084","198360998782893633262631085754804720380","337059962214239611254703979440267923230","283505832479442296594998392059062770419","50387266226148308870716824965847541097","185905045048758120967181260671958377608","199322783334443109153201596635245680898","328830729389762730052539085865397241511","128423991711865999419976302831926995367","122125706197825976152840539678398969859","179291757978757140930595631820755819540","283505832479442296594998392059062770419","100228635625201181189785279989684543730","28248475088257421734657325021442808590","170276784351170133688633550666439336728","328830729389762730052539085865397241511","314135951855850568371304621985805311184","157393389003104658903706098726165691765","96132357251727382323635709079272040671","202892845440725699784175262217462372191","74030793613587768650294872271910637210","176759970996124561491525196914738500810","283505832479442296594998392059062770419","180196826741541800616720987866703442572","158476025152132506480981525650694847984","279940992644320497525644768820852875483","328830729389762730052539085865397241511","283341982703186656712102047206086442710","258359756719039924232822270639396562023","247448104874748068543160301149657223823","136706969352643176391896878269797158365"],"threshold":0.9},"id":"CVE-2025-32972-fc7f50c1","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e","target":{"file":"xwiki-platform-core/xwiki-platform-lesscss/xwiki-platform-lesscss-script/src/test/java/org/xwiki/lesscss/LessCompilerScriptServiceTest.java"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"}]}