Login Request a demo
Medium severity · published Apr 30, 2025
CVE-2025-32972
The lesscss script service allows cache clearing without programming right
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
XWiki is a generic wiki platform. In versions starting from 6.1-milestone-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the script API of the LESS compiler in XWiki is incorrectly checking for rights when calling the cache cleaning API, making it possible to clean the cache without having programming right. The only impact of this is a slowdown in XWiki execution as the caches are re-filled. As this vulnerability requires script right to exploit, and script right already allows unlimited execution of scripts, the additional impact due to this vulnerability is low. This issue has been patched in versions 15.10.12, 16.4.3, and 16.8.0-rc-1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XW
xwiki-platform · xwiki
>= 6.1-milestone-1, < 15.10.12; >= 16.0.0-rc-1, < 16.4.3; >= 16.5.0-rc-1, < 16.8.0-rc-1 · source: vendor
XW
Xwiki · Xwiki
6.2 before 15.10.12; 16.0.0 before 16.4.3; 16.5.0 before 16.8.0; 6.1; 6.1; 6.1; +1 more · source: NVD
Affected product
XW
xwiki-platform
xwiki
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-32972
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-32972
Patch
https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e
Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rp38-24m3-rx87
Issue Tracking
https://jira.xwiki.org/browse/XWIKI-22462
More from xwiki-platform
9.8
CVE-2025-24893
Remote code execution as guest via SolrSearchMacros request in xwiki
9.8
CVE-2026-33229
XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API
9.8
CVE-2025-54385
XWiki Platform's searchDocuments API allows for SQL injection
9.8
CVE-2025-32429
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
9.8
CVE-2024-56158
XWiki allows SQL injection in query endpoint of REST API with Oracle