{"id":"CVE-2025-49584","summary":"XWiki makes title of inaccessible pages available through the class property values REST API","details":"XWiki is a generic wiki platform. In XWiki Platform versions 10.9 through 16.4.6, 16.5.0-rc-1 through 16.10.2, and 17.0.0-rc-1, the title of every single page whose reference is known can be accessed through the REST API as long as an XClass with a page property is accessible, this is the default for an XWiki installation. This allows an attacker to get titles of pages whose reference is known, one title per request. This doesn't affect fully private wikis as the REST endpoint checks access rights on the XClass definition. The impact on confidentiality depends on the strategy for page names. By default, page names match the title, so the impact should be low but if page names are intentionally obfuscated because the titles are sensitive, the impact could be high. This has been fixed in XWiki 16.4.7, 16.10.3 and 17.0.0 by adding access control checks before getting the title of any page.","aliases":["GHSA-mvp5-qx9c-c3fv"],"modified":"2026-08-12T15:16:35.730112Z","published":"2025-06-13T17:21:33.575Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49584.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-201"]},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22736"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49584.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mvp5-qx9c-c3fv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49584"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"414fb113aceb2ce5f948d26835a2f3bc7df0d50b"},{"fixed":"c3bb3381253c71df533fe0c31a02d3ce1e04bae7"},{"introduced":"526fcc68b3f75862a2af7395b5a6dfdd3d2166a5"},{"fixed":"1b4e258d6d1cbc10a803d3e071d038edb2d28b97"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"10.9"},{"fixed":"16.4.7"},{"introduced":"16.5.0"},{"fixed":"16.10.3"}]}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"9d7ccc604c0981fe31efd8a265057906b2081d21"},{"fixed":"f5a9a0762750936523187286919ec4c1892d6fea"},{"introduced":"177e524c2e218fe5de776619271b7cd12c929488"},{"fixed":"8cde0f326b60732330378e3ac10c630021e9cad7"},{"fixed":"ee642f973a7c95d2d146fe03c81bcdee1871f4ec"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"10.9"},{"fixed":"16.4.7"},{"introduced":"16.5.0"},{"fixed":"16.10.3"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49584.json","vanir_signatures_modified":"2026-08-12T15:16:35Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/PageClassPropertyValuesProvider.java"},"deprecated":false,"digest":{"line_hashes":["247737908986750908363155858902595652624","267430052724371847144361948905731509059","127540842794538490929952853403969333383","63593931887475681361596090581152097990","95450419653133474856080600837671723263","179101817659455791493915737740166822403","199025361995292072672423374625829225186","136461563071304985128119582630726234236","27047467332484193870438059072928333180","335280221549889700107604319248013873855","160851003329675005620317758286705503610","301824742430404341073100970298186659064","272084784876817986712213564934116428095","209942931505294409457347998380974658450","90086277529824800168415834825440536240","37507739884213655242594748773750159991","218116660305800784585153462217675049084","307261160677155309788295688552011669756"],"threshold":0.9},"id":"CVE-2025-49584-03fdcda3"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/AbstractListClassPropertyValuesProviderTest.java"},"deprecated":false,"digest":{"line_hashes":["156752728491459665434696194984073776873","132822041600642984619960262877907498821","337385257650431302388376331287598810503","284082868834099581173311384077046966683","273109506575137068961150378187161451712","200827839922356952540013242582324881950","14934367230609982907745922690193124735","80524719834316806653334361133149906696","236568030158922429118270886039989657660","291865506651925216735767626367558463391","21201541050662820748985471872311856652","42765113319045785820194954362516798044","265384795873358464567949344488723599123","29792046194386136714717797405754100468","309868830143754697978134766163089164065","62451475235261148623643260711897991895","155636411496263798134800625447329411821","320176734764370502817504815732379424670","218985518932446063615835965144231013605","7550824231317330175473423490766630711","35575454470569963382285120707213280236","162235616067638672743353387313727102707","155595063283762533641862834675540251861","147069211739879213312851296175995803198","247922054257056416555863189873808900175","289930429866351176411518062163220913103","218349540286784876460866135646061146734","224444799262732930642662857721899401371"],"threshold":0.9},"id":"CVE-2025-49584-05b1fe22"},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/AbstractDocumentListClassPropertyValuesProvider.java"},"deprecated":false,"digest":{"line_hashes":["45102229131787161134129794195259022816","15148942939027763578437364663610372952","312098160621005355547844798455847465020","154779772894130128970223941892063452276","31641866773638191178433735489106646800","278202581418378327690466917663450626449","185361028414616349552451432345552259721","105076118185251762716191665651387897291","321683727844146523331663952540127420929","3494217810212320204714183829507483991","1080523246629092304419805005481126878"],"threshold":0.9},"id":"CVE-2025-49584-165db31e","signature_type":"Line"},{"digest":{"function_hash":"14378042723736434381145644890772087877","length":543},"id":"CVE-2025-49584-1c5c2e64","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/PageClassPropertyValuesProvider.java","function":"getLabel"},"deprecated":false},{"target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/PageClassPropertyValuesProviderTest.java","function":"getValuesWithTerminalPage"},"deprecated":false,"digest":{"function_hash":"312584759197525879015548156089563469828","length":2125},"id":"CVE-2025-49584-27a6fd44","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/PageClassPropertyValuesProviderTest.java"},"deprecated":false,"digest":{"line_hashes":["159612671607888667184468614472882410553","172109912723709229122122669964036359835","329516655351258160202165733929119163107","291106183467248836959235127784236817768","335121594807315134435178884515803317250","61022799438741783664955949005065830613","3818497134696403962601179360878606142","288615183372711420803331942704028082362","311831605474943844177437123166622867418","44620087412673509678717651441464383245","185932986602649290284051203558541718608","191617783518316192257928596225904708561","240519820518223752284773737785637491201","193040098213903611501081945789158468740","156690970409470233610389965437201768047","86992130650277697588319001292194886933","131074708782691749451023390938535569741","253426425436940861813771079847645833069","223888529045231920792539255928671708699","121545858433858259808181788860231170668","94358661260114109150632034619291749736","285665828223360398376905595098901375418","90620176822925035209308906872735778022","58526485464675211678384950290389324531","321156035114615853730583182624223458149","239134284946250409375330040043589263155","6245445309390285129468392971540533474","18619836943923687198917504685745859474","262158883148641798945050226999388577564","207771939270556263910745123239038576278","135590088493954916467694460745480451142","48167833096664230229426470253553594528","66800272593074309889710674657200899133","107134440928808710279171493575294135268","248539583390590088062010258192875763862","119524654118627371521971806105467566824","178550246420105305395083709340003138305","223114386327426433556604326877854126084","56533396705841587603080968035575482911","207771939270556263910745123239038576278","248632312618477404245924517715160096905","231086230953574848271791017755163172476","42843020749470484968400995831495486986","80315372744537548205689975730225329913","106258681813804435984163368909912224234","294876340309680250025042074753626125807","313764781720878175878821443486494174484","277219632005972692255162518402584993932","172881520019012183689967008737615564042"],"threshold":0.9},"id":"CVE-2025-49584-574026ea"},{"source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/GroupsClassPropertyValuesProvider.java","function":"getIcon"},"deprecated":false,"digest":{"length":1039,"function_hash":"276559334339863714229037384312915354950"},"id":"CVE-2025-49584-8097fad8","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"55303040393984022624833389419958653849","length":1106},"id":"CVE-2025-49584-8745bdb7","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/UsersClassPropertyValuesProvider.java","function":"getIcon"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/UsersClassPropertyValuesProvider.java"},"deprecated":false,"digest":{"line_hashes":["78574802939534701696037118479721443758","262632653147496385566394568833817756631","90711065738190121288715203883598619127","30418863133186240928359954259568934700","165408608967512860981875196328819083302","224025263015949403048385263800859742564","301548366467436308030321827324026632746","6593009407224709072185310887080442718","309446517269005571868015244648640775597","84486910026711355000776829036625695476","213044029433551550513435494897747638380","153632878859969747679830703449431547941","336533508518923517306755023466768474295","130352706656437423295683973397713427012","20646642196911332464429632881785730720","188350741282204207888252793221188824071","219583642057884195348848094091833246550","27323840758258474358220896722048600575","79205503479849778674711125490915491001","156877069020460533643944742923962104138","202268236074648355218784602705261406826","3769337030350747139407965888131991852"],"threshold":0.9},"id":"CVE-2025-49584-92dcadd1"},{"id":"CVE-2025-49584-96b48f65","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec","target":{"function":"getValue","file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/AbstractDocumentListClassPropertyValuesProvider.java"},"deprecated":false,"digest":{"function_hash":"98469165261679720633192256304734899019","length":446}},{"deprecated":false,"digest":{"line_hashes":["10714916665244311502400453703612341454","127881920231562937401359073603859142602","260281550753435254094366451869812110190","50911291492924950040979741858567437762","132151965618256714521996207542416434169","293152679478092789948730980016404688779","298864847905384288958503937781666898924","269466410000786879615505242765549871569","169864761323538076109832247277862955915","195799163325783940505067967757716257474","168614012282558062018440968741343321778","49507172460120888438862244359337860761","236724518285972693662371316935060019339","69471656533826696505556345143875130747","15665426146033611044458651449886653711","129778972221818241744150773320833549780","148633691273869004604563874301017643895","300459385187409380968301915252508857685","163122918011877456820121971555813417888","198880165266743174058633460952697225733","211444459619927430752513043277599322522","90551026909022285759957355073113942344","112337213448040800929485329644059529283","235061206531164615889962428056172215584","279224175221165373747592349884135318319","239082083059774290288071293796629654238","289743310095826129241873450788160380314","15844021061854683603277217075179156149","184325020273824171612979063961265766204","98245920623695534489539073742951124073","54933699902025407693675276370195413335","134038915815981856557972959687837291292","38497703684947358471863542559761519437","147709499968653069048852348226461640155"],"threshold":0.9},"id":"CVE-2025-49584-989b20e8","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/GroupsClassPropertyValuesProviderTest.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/GroupsClassPropertyValuesProvider.java","function":"getLabel"},"deprecated":false,"digest":{"function_hash":"317452003452074004568603034824774384211","length":461},"id":"CVE-2025-49584-989e8d92"},{"target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/UsersClassPropertyValuesProviderTest.java"},"deprecated":false,"digest":{"line_hashes":["168638991738471313688421490694306295903","54593504555034901895097321294118326641","260281550753435254094366451869812110190","50911291492924950040979741858567437762","31486935500204367861141541616138669360","8269812889107629934058998997626535151","170766177744077106380459216788141340896","324789500597018918477630938339959642912","181558684262218111831156430427372014441","15665426146033611044458651449886653711","129778972221818241744150773320833549780","148633691273869004604563874301017643895","300459385187409380968301915252508857685","63303524642856752780760962478034372484","20773022201551614371841110751404836069","36125975653966261529194022216085253036","192825404600669124295535883355264778935","27442915510151779601989901938114799036","312667302268284173402192149388027225002","187199756849405234879338876092173426895","300205197901768714405254194663136408455","29511866159043091240560068971330922105","36706071871783471628900012197715769504","193020888950857140434304778647382585276","71485184117655720295465312761091115756","17983380798989321363085343879437167193","58514053501137731651492763959811916429","73449373131366501030644796712754767836"],"threshold":0.9},"id":"CVE-2025-49584-ab985102","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec"},{"digest":{"function_hash":"173895688181633827773667548111410238195","length":3976},"id":"CVE-2025-49584-b233980e","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/UsersClassPropertyValuesProviderTest.java","function":"getValuesLocal"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/GroupsClassPropertyValuesProviderTest.java","function":"getValuesLocal"},"deprecated":false,"digest":{"function_hash":"164678246616924864227283845483164031031","length":2222},"id":"CVE-2025-49584-b3cbfd6e","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"100254114779353006493733707240446980328","length":898},"id":"CVE-2025-49584-b6cee9a5","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/AbstractListClassPropertyValuesProviderTest.java","function":"configure"}},{"id":"CVE-2025-49584-d6a88f8d","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec","target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/main/java/org/xwiki/rest/internal/resources/classes/GroupsClassPropertyValuesProvider.java"},"deprecated":false,"digest":{"line_hashes":["166414000715344640459153174500385002518","278860016259195573031161242873130114832","103897316577602550855589274152623692711","90202944096806929601969863048100178991","224025263015949403048385263800859742564","106021376449245013372190136712781939736","121025296288160567180034911571948155018","190071077906773303163509176107218508797","240370049704121057559099821687666808628","249168503052257881598012128027674004155","293206405999384477974721238668072959196","130352706656437423295683973397713427012","20646642196911332464429632881785730720","188350741282204207888252793221188824071","163022116439903809640158807692472134660","138646885214900172284404610026935361625","221308398393138623587605099735425333951","47865501250053962000260369307226917332","180055672272117520046689121516332476420","3769337030350747139407965888131991852","69811253121480606737043109609503273407","295474503075510992261967499087944173448","78334745749388360936034080808357504064","313475268025745319082594501612590203118","257980748617232666523885280006578129678","110834026136658225067902538202429093189","95236561991913077533466049187753505226","88541519937738299231900170046344506","216633546480406730252057779432773752903","321920622402928049170343891576885701982","258597240667769088228086172497358040024"],"threshold":0.9}},{"target":{"file":"xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-server/src/test/java/org/xwiki/rest/internal/resources/classes/PageClassPropertyValuesProviderTest.java","function":"getValues"},"deprecated":false,"digest":{"function_hash":"169524343940508158302516448184993361016","length":1550},"id":"CVE-2025-49584-f8a75b24","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/ee642f973a7c95d2d146fe03c81bcdee1871f4ec"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}