What is the CVSS score of CVE-2025-49584?

CVE-2025-49584 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2025-49584?

Yes, a public proof-of-concept exploit is available for CVE-2025-49584. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-49584?

Within 24 hours: Inventory all XWiki instances and their current versions. Within 7 days: Apply vendor patches (16.4.7, 16.10.3, or 17.0.0) to all affected systems. Within 30 days: Conduct a security audit to determine if page titles were accessed through this vulnerability and assess whether naming strategy changes are needed.

Xwiki CVE-2025-49584

Q: Which versions of Xwiki are affected by CVE-2025-49584?

XWiki installations are vulnerable to unauthorized disclosure of page titles through the REST API, potentially exposing sensitive information if page names have been intentionally obscured.. A patch is available.

EUVD-2025-18305 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2025-06-13 security-advisories@github.com

GHSA-mvp5-qx9c-c3fv

Information Disclosure Xwiki

7.5

CVSS 3.1 · GitHub Advisory

View

Vulnerability Assessment

Weakness	CWE CWE-201 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Outbound data filtering
Impact	CVSS 7.5. EPSS 0.0%. Public PoC/exploit available. Vendor patch available.
Exploit ScenarioDerived	An attacker could exploit this vulnerability in XWiki Platform to compromise the security of affected deployments, potentially impacting confidentiality, integrity, or availability.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 14, 2026

A security vulnerability in XWiki Platform (CVSS 7.5) that allows an attacker. Risk factors: public PoC available. Vendor patch is available.

Earlier versions of this analysis (1)

v1 Mar 14, 2026 - 21:34 CVSS 7.5

XWiki is a generic wiki platform. In XWiki Platform versions 10.9 through 16.4.6, 16.5.0-rc-1 through 16.10.2, and 17.0.0-rc-1, the title of every single page whose reference is known can be accessed

RemediationAI

Apply the vendor-supplied patch immediately.

Affected VersionsENISA

xwiki-platform 10.9, < 16.4.7

xwiki-platform 16.5.0-rc-1, < 16.10.3

xwiki-platform 17.0.0-rc-1, < 17.0.0

Affected Packages

maven org.xwiki.platform:xwiki-platform-rest-server fix: 16.4.7, 16.10.3, 17.0.0

euvd xwiki_platform_10_9 fix: 16.4.7

euvd xwiki_platform_16_5_0_rc_1 fix: 16.10.3

euvd xwiki_platform_17_0_0_rc_1 fix: 17.0.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-201 (Information Exposure via Sent Data). CVSS 7.5 indicates high severity. Affects XWiki Platform.

Know when Xwiki gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 14, 2026 - 21:34 nvd

Patch available

PoC Detected

Sep 03, 2025 - 17:48 vuln.today

Public exploit code

CVE Published

Jun 13, 2025 - 18:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

XWiki is a generic wiki platform. In XWiki Platform versions 10.9 through 16.4.6, 16.5.0-rc-1 through 16.10.2, and 17.0.0-rc-1, the title of every single page whose reference is known can be accessed through the REST API as long as an XClass with a page property is accessible, this is the default for an XWiki installation. This allows an attacker to get titles of pages whose reference is known, one title per request. This doesn't affect fully private wikis as the REST endpoint checks access rights on the XClass definition. The impact on confidentiality depends on the strategy for page names. By default, page names match the title, so the impact should be low but if page names are intentionally obfuscated because the titles are sensitive, the impact could be high. This has been fixed in XWiki 16.4.7, 16.10.3 and 17.0.0 by adding access control checks before getting the title of any page.

Executive ViewAI

Why It Matters

XWiki installations are vulnerable to unauthorized disclosure of page titles through the REST API, potentially exposing sensitive information if page names have been intentionally obscured. This affects XWiki versions 10.9 through 16.10.2 and 17.0.0-rc-1, with public exploits available, requiring immediate patching to prevent information leakage.

Business Impact: Medium

Compensating Controls

Apply vendor patch. If patching is delayed: Implement WAF rules to restrict REST API access to authenticated users only; restrict access to pages with XClass definitions; disable the REST API endpoint temporarily if not required for operations; segment XWiki instances on a restricted network with limited external access.

Threat Intelligence Overview

EPSS Score

0.0%

Top 88% exploitable

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.