CVE-2025-66472

描述

### Impact A reflected XSS vulnerability in XWiki allows an attacker to send a victim to a URL with a deletion confirmation message on which the attacker-supplied script is executed when the victim clicks the "No" button. When the victim has admin or programming right, this allows the attacker to execute basically arbitrary actions on the XWiki installation including remote code execution. ### Patches This vulnerability has been patched in XWiki 16.10.10, 17.4.2 and 17.5.0 by using the affected URL parameter only in the intended context. ### Workarounds The [patch](https://github.com/xwiki/xwiki-platform/commit/cb578b1b2910d06e9dd7581077072d1cfbd280f2) can be manually applied to the templates that are present in the WAR. A restart of XWiki is needed for the changes to be applied.

如何修補 CVE-2025-66472

要修補 CVE-2025-66472,請將受影響套件升級到下列已修補版本。

• —升級至 16.10.10 或更新版本
• —升級至 16.10.10 或更新版本

CVE-2025-66472 正在被利用嗎?

低 — EPSS 為 0.1%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• >= 6.2-milestone-1, < 16.10.10
• >= 6.2-milestone-1, < 16.10.10

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-66472
• PATCHgithub.com/xwiki/xwiki-platform
• WEBgithub.com/xwiki/xwiki-platform/commit/cb578b1b2910d06e9dd7581077072d1cfbd280f2
• WEBgithub.com/xwiki/xwiki-platform/security/advisories/GHSA-7vpr-jm38-wr7w