CVE-2025-66473

XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API which doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of pages in the wiki and the memory configuration, this can lead to slowness and unavailability of the wiki. As an example, the /rest/wikis/xwiki/spaces resource returns all spaces on the wiki by default, which are basically all pages. This issue is fixed in versions 17.4.4 and 16.10.11.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/xwiki/xwiki-platform/commit/e3c47745195fb445b054537be86f5c01ee69558b	Patch
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cc84-q3v3-mhgf	Patch Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-23355	Patch Vendor Advisory
https://jira.xwiki.org/browse/XWIKI-23355	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:xwiki:xwiki::::::::
	cpe:2.3:a:xwiki:xwiki::::::::
	cpe:2.3:a:xwiki:xwiki::::::::

History

25 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) XWiki es una plataforma de software wiki de código abierto. Las versiones 16.10.10 e inferiores, 17.0.0-rc-1 hasta 17.4.3 y 17.5.0-rc-1 hasta 17.6.0 contienen una API REST que no impone ningún límite para el número de elementos que se pueden solicitar en una única solicitud en este momento. Dependiendo del número de páginas en la wiki y la configuración de la memoria, esto puede provocar lentitud e indisponibilidad de la wiki. Como ejemplo, el recurso /rest/wikis/xwiki/spaces devuelve todos los espacios de la wiki por defecto, que son básicamente todas las páginas. Este problema está solucionado en las versiones 17.4.4 y 16.10.11.

Information

Published : 2025-12-10 22:16

Updated : 2026-09-25 23:10

NVD link : CVE-2025-66473

Mitre link : CVE-2025-66473

CVE.ORG link : CVE-2025-66473

JSON object : View

Products Affected

xwiki

xwiki

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2025-66473", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66473", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-11T15:39:41.356268Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "xwiki", "product": "xwiki-platform", "versions": [{"status": "affected", "version": "< 16.10.11"}, {"status": "affected", "version": ">= 17.0.0-rc-1, < 17.4.4"}, {"status": "affected", "version": ">= 17.5.0-rc-1, < 17.7.0-rc-1"}]}]}], "published": "2025-12-10T22:16:27.850", "references": [{"url": "https://github.com/xwiki/xwiki-platform/commit/e3c47745195fb445b054537be86f5c01ee69558b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-cc84-q3v3-mhgf", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://jira.xwiki.org/browse/XWIKI-23355", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://jira.xwiki.org/browse/XWIKI-23355", "tags": ["Patch", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API which doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of pages in the wiki and the memory configuration, this can lead to slowness and unavailability of the wiki. As an example, the /rest/wikis/xwiki/spaces resource returns all spaces on the wiki by default, which are basically all pages. This issue is fixed in versions 17.4.4 and 16.10.11."}, {"lang": "es", "value": "XWiki es una plataforma de software wiki de c\u00f3digo abierto. Las versiones 16.10.10 e inferiores, 17.0.0-rc-1 hasta 17.4.3 y 17.5.0-rc-1 hasta 17.6.0 contienen una API REST que no impone ning\u00fan l\u00edmite para el n\u00famero de elementos que se pueden solicitar en una \u00fanica solicitud en este momento. Dependiendo del n\u00famero de p\u00e1ginas en la wiki y la configuraci\u00f3n de la memoria, esto puede provocar lentitud e indisponibilidad de la wiki. Como ejemplo, el recurso /rest/wikis/xwiki/spaces devuelve todos los espacios de la wiki por defecto, que son b\u00e1sicamente todas las p\u00e1ginas. Este problema est\u00e1 solucionado en las versiones 17.4.4 y 16.10.11."}], "lastModified": "2026-09-25T23:10:00.463", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FCDB8F94-5FBD-4A22-A417-54E965A9836F", "versionEndExcluding": "16.10.11"}, {"criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10175AF0-04B1-4BE0-9657-532EEC0AB6A9", "versionEndExcluding": "17.4.4", "versionStartIncluding": "17.0.0"}, {"criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "649548AF-281D-4CD9-9672-7BB8F25BEF12", "versionEndIncluding": "17.6.0", "versionStartIncluding": "17.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}