CVE-2025-54124: XWiki Platform Oldcore Vulnerability Leading to Password Hash Exposure
Summary
CVE-2025-54124: XWiki leaks password hashes and other accessible password properties. Affects org.xwiki.platform:xwiki-platform-oldcore across 3 version ranges.
>= 9.8-rc-1, < 16.4.7
>= 16.5.0-rc-1, < 16.10.5
>= 17.0.0-rc-1, < 17.2.0-rc-1
Fixed in 16.4.7, 16.10.5 or 17.2.0-rc-1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The XWiki Platform, particularly the 'xwiki-platform-oldcore' package, is an open-source wiki software that allows users to create, manage, and share content collaboratively. It provides a rich set of features, including user management, page editing, and extensibility through plugins. However, a critical vulnerability has been identified that allows users with edit rights to expose sensitive password information.
Vulnerability Detail
The vulnerability arises from the ability of any user with edit rights on a wiki page to create an XClass that includes a database list property referencing a password property. This setup can lead to the unintended exposure of password hashes stored for users when objects of that XClass are added. Consequently, any user with an account on the wiki can access password hashes of all users, posing a significant security risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.8-rc-1, < 16.4.716.4.7 -
>= 16.5.0-rc-1, < 16.10.516.10.5 -
>= 17.0.0-rc-1, < 17.2.0-rc-117.2.0-rc-1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no known workarounds to mitigate this vulnerability without applying the patch. Users are advised to update to the patched versions as soon as possible.
Conclusion
In summary, CVE-2025-54124 is a significant vulnerability in the XWiki Platform that can lead to the exposure of password hashes. Users are strongly encouraged to update to the latest patched versions to secure their applications against this threat.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-oldcore →
FAQ
CVE-2025-54124 is a vulnerability in the XWiki Platform that allows users with edit rights to expose password hashes of other users.
You can use Vulert, which monitors open-source vulnerabilities in real-time using just the pom.xml file. Visit Vulert Scanner to check your application without any signup.
The vulnerability affects versions prior to 16.4.7, 16.10.5, and 17.2.0 of the 'xwiki-platform-oldcore' package.
The primary consequence is the potential exposure of sensitive password hashes, which can lead to unauthorized access and compromise user accounts.
Currently, there are no known workarounds to mitigate this vulnerability. Updating to a patched version is the recommended action.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-oldcore.
