Detections
Analytics
SCA: security update for org.xwiki.platform:xwiki-platform-security-authorization-bridge (GHSA-rhfv-688c-p6hp)
medium Tenable Self-Hosted Container Security Plugin ID 434775
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- XWiki is a generic wiki platform. In XWiki 16.10.0, required rights were introduced as a way to limit
which rights a document can have. Part of the security model of required rights is that a user who doesn't
have a right also cannot define that right as required right. That way, users who are editing documents on
which required rights are enforced can be sure that they're not giving a right to a script or object that
it didn't have before. A bug in the implementation of the enforcement of this rule means that in fact, it
was possible for any user with edit right on a document to set programming right as required right. If
then a user with programming right edited that document, the content of that document would gain
programming right, allowing remote code execution. This thereby defeats most of the security benefits of
required rights. As XWiki still performs the required rights analysis when a user edits a page even when
required rights are enforced, the user with programming right would still be warned about the dangerous
content unless the attacker managed to bypass this check. Note also that none of the affected versions
include a UI for enabling the enforcing of required rights so it seems unlikely that anybody relied on
them for security in the affected versions. As this vulnerability provides no additional attack surface
unless all documents in the wiki enforce required rights, we consider the impact of this attack to be low
even though gaining programming right could have a high impact. This vulnerability has been patched in
XWiki 16.10.4 and 17.1.0RC1. No known workarounds are available except for upgrading. (CVE-2025-48063)
See Also
Plugin Details
Severity: Medium
ID: 434775
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 8/19/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: High
Score: 7.6
Percentile: 98.48
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2025-48063
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 4.8
Threat Score: 1.9
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/21/2025
Vulnerability Publication Date: 5/21/2025
Reference Information
CVE: CVE-2025-48063
cwe: CWE-285