{"id":"CVE-2025-54124","summary":"XWiki Platform: Any user with editing rights can access password properties through Database List Properties","details":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 9.8-rc-1 through 16.4.6, 16.5.0-rc-1 through 16.10.4, and 17.0.0-rc-1 through 17.1.0, any user with editing rights can create an XClass with a database list property that references a password property. When adding an object of that XClass, the content of that password property is displayed. In practice, with a standard rights setup, this means that any user with an account on the wiki can access password hashes of all users, and possibly other password properties (with hashed or plain storage) that are on pages that the user can view. This issue is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1.","aliases":["GHSA-r38m-cgpg-qj69"],"modified":"2026-08-12T15:16:41.072524Z","published":"2025-08-05T23:28:07.166Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-359"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54124.json"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/XWIKI-22811"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54124.json"},{"type":"ADVISORY","url":"https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r38m-cgpg-qj69"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54124"},{"type":"FIX","url":"https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/xwiki/xwiki-commons","events":[{"introduced":"6ab06251c8d1489c8f927b45bc4acd36c1dbae76"},{"fixed":"c3bb3381253c71df533fe0c31a02d3ce1e04bae7"},{"introduced":"526fcc68b3f75862a2af7395b5a6dfdd3d2166a5"},{"fixed":"da9d6819960ace1821a784a8441e523fe6fc94d5"},{"introduced":"e84d9bd1b4c0c8219597e10acfd8fbd692416294"},{"last_affected":"7f1dd9fba90aca38f2ab8d5325bf93c24543a730"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"9.8"},{"fixed":"16.4.7"},{"introduced":"16.5.0"},{"fixed":"16.10.5"},{"introduced":"17.0.0"},{"last_affected":"17.1.0"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/xwiki/xwiki-platform","events":[{"introduced":"241f662165bb59e77b302b3321909eb47668bf10"},{"fixed":"f5a9a0762750936523187286919ec4c1892d6fea"},{"introduced":"177e524c2e218fe5de776619271b7cd12c929488"},{"fixed":"f7ffb1f0f550da6c1d6ce60643aa9759e83f99f3"},{"introduced":"7edb5b7d98170ec081c7e30237971d7dfb8a4401"},{"fixed":"f2ca8649cba2ed3765061660bf5c7f801afa0b24"}],"database_specific":{"cpe":"cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"9.8"},{"fixed":"16.4.7"},{"introduced":"16.5.0"},{"fixed":"16.10.5"},{"introduced":"17.0.0"},{"last_affected":"17.1.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54124.json","vanir_signatures_modified":"2026-08-12T15:16:41Z","vanir_signatures":[{"digest":{"function_hash":"25588946401877469368883697837870900964","length":278},"id":"CVE-2025-54124-122d999a","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilderTest.java","function":"assertQuery"},"deprecated":false},{"target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilder.java","function":"getStatementWhenIdOrValueFieldsAreSpecified"},"deprecated":false,"digest":{"function_hash":"8565411168989470519648455557406968505","length":525},"id":"CVE-2025-54124-2252b675","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24"},{"digest":{"line_hashes":["9430737612104126761664851420056040295","232814941356848113137345721236504791193","119990194581517246625838795633665276734","267234776772717326609826758689299801215","194626504125535609403855122803490179103","249236333702770804220339674009796643091","86979270488880742015819241904343013029","191787495568820788386353291831381738004","316156611602210005911757058317079813348","145074299577700336584791207007534601691","207376324821807455774417225476855826604","16918185377285629193992726663966056052","86773165941627178512733047590175710475","309350962900639321504041114836239592776","6545238761161548852765113541895657655","184519221254701900262409628602974298979","19954025902313672387300834357174343639","76357480094675595296743706496325056181","21100514686129300411229723930476672096","261426417696032871443592661600408915210","139773600488288472628428203487004505973","159398918706843467195465288601134153776","35661851879181406057324047389755873513","258625132629845939921924379501107616008","311794320011510375412687169663254704925","332683154832639583281569014706722721197","131022618804411689102677023817805771580","198086118803829288386256498309394951071","312229950817486132124075850088531845709","235252927129811579246860266887680422061","20722929829990479611590000739158603051","280768559398315745104307181349609255458","325260339226706337086322288070392544906","136188500958400511325690304990030992700","234230796420224960847798805705347238403","41897987236082675802406637173711066616","244951874954603544754215467207246100988","302733611526470559036927469928039280389","127963255389892801074907302492917953887","300539661873332618209421603200711928758","23985872136856799177472281471113269193","124753308736566474181357199132730068897","288831957372422990250897282372825527905","264988369144360178465305514081083180394","30074746959010401056774180450183075338","12169587067235696465103933849481490760","21464395984059554186816832587531010713","151124289061124868845787746954526103262","55687235488837179153470695406688956020","261713734980704948038121983699606097486","331008866533146868237233074012767162279","183775170164620540784976721382539592082","19242472501377059004073966709254580625","87015345844325902596627298083391864833","25120267064679817459952925001309849032","42021516339337970156168621447037235948","314079068552986783026457087301967338414","294514039554706003510519417973834508120","47246775570181621128015147635503549200","256222781277228200903276524924602361252","186495780612956694628396676429621063508","154059794178047699039970640934873635269","149235955086545417552905336368749651930","107614266355376204595652731990368345368","248854171503436428570657465903566197648","168433355261322413016204227799686129217","254714358950712411935644515984102876717","34813886275789742989898821243747340446","157579904967092812505224556778042342214","246894696901175662191072202425767328987","9566792057004915941738565526294210090"],"threshold":0.9},"id":"CVE-2025-54124-6b829455","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilderTest.java"},"deprecated":false},{"source":"https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilder.java","function":"getStatementWhenIdFieldIsSpecified"},"deprecated":false,"digest":{"function_hash":"153217571392003286122272293474929253064","length":1459},"id":"CVE-2025-54124-6cb7946d","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"length":528,"function_hash":"307823744661072181184920036927472797345"},"id":"CVE-2025-54124-7ce7be8a","signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilder.java","function":"addFieldToQuery"}},{"deprecated":false,"digest":{"line_hashes":["230858229873406835534393344686209283206","57608221344348083845724934030115009349","13153002476370662215552005562743474463","195856933316167992070229943307207098034","313750038001224873922536706004627100203","107594134025218679778079705293910751254","278564690786023840406836389456147212028","213297694565389891885139239680313799940","262715718945567333297458278851601465607","272050620557458171320020100815678534586","301825700194826585776811522400358319267","231380269004861631747211174307692962769","317559028041180602673305018438272918339","212480594403909680286443468144418005492","120981174045823506109930506847088308720","335355690711749491120177704511418336358","70726860669442020250621325197240866197","193076965279154054974981026016935596823","242001531817141354982158598897344539095","234204687429283437563883883949534491066","125506146143484036724096383059685088187","58793186728997274535163326360399667478","296865274879879115424771965600981719777","55850783724821463411946782124873553907","286948810215121984500798122269040703089","87879334640435543146488061256637071113","318544225186794719682318624864587137246","191763487303751778763733542077524729016","156836061001278471892762245676638507135","283436706751665912036526831029877937087","12545969314674239680792604543456265493","209859634803940457209407482945253208911","54444722187118174594013259224784086968","8659739287308300024475486687530586241","278889315781478408975317224799096045599","173493026909964655720970758913680697659","178826314398077703352073456727339784137","263130243135541702042006002514404698037","64389203643994276852895635898120335302","33144240593021047945382548904743460184","327285510551167026225099830859407820254","279181360975741440744906491382222404317","30273994894879301499354625685863319604","152267674513638299472550744258593708482","41543576488846275991680623292970284049","85923158625666762609851596431083000135","106146486446252204002856992856153950081","325903631368572804344522534399210387047","179791636828333472512996385188758731719","151628863395879411413848295853109089685","70097959204253015832142851682673689396","312101828913823249499696853558381185210"],"threshold":0.9},"id":"CVE-2025-54124-a3bebb75","signature_type":"Line","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilder.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24","target":{"file":"xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/internal/objects/classes/ImplicitlyAllowedValuesDBListQueryBuilderTest.java","function":"configure"},"deprecated":false,"digest":{"length":392,"function_hash":"211526893444501261481378754755513416636"},"id":"CVE-2025-54124-b2a0793f"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}