CVE-2025-54124

Summary

XWiki leaks password hashes and other accessible password properties

Severity

high

EPSS

0.4% (p31)

Also known as

GHSA-r38m-cgpg-qj69#org.xwiki.platform:xwiki-platform-legacy-oldcore, GHSA-r38m-cgpg-qj69#org.xwiki.platform:xwiki-platform-oldcore

Published

2025-08-05

References

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r38m-cgpg-qj69
• https://nvd.nist.gov/vuln/detail/CVE-2025-54124
• https://github.com/xwiki/xwiki-platform/commit/f2ca8649cba2ed3765061660bf5c7f801afa0b24

Related advisories

• CVE-2024-56158 — critical · Maven/org.xwiki.platform:xwiki-platform-oldcore
• CVE-2024-43400 — critical · Maven/org.xwiki.platform:xwiki-platform-oldcore
• CVE-2024-37899 — critical · Maven/org.xwiki.platform:xwiki-platform-oldcore
• CVE-2024-31987 — critical · Maven/org.xwiki.platform:xwiki-platform-oldcore
• CVE-2024-31981 — critical · Maven/org.xwiki.platform:xwiki-platform-oldcore
• CVE-2026-33229 — high · Maven/org.xwiki.platform:xwiki-platform-oldcore
• CVE-2025-54125 — high · Maven/org.xwiki.platform:xwiki-platform-oldcore
• CVE-2025-54385 — high · Maven/org.xwiki.platform:xwiki-platform-oldcore

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity