CVE-2025-54990: Unauthorized Access to SpammedPages in XWiki AdminTools

Overview

CVE-2025-54990 is a medium-severity vulnerability affecting XWiki AdminTools versions prior to 1.1. This vulnerability allows users without administrative privileges to access the AdminTools.SpammedPages page, which should be restricted to administrators only. While the page doesn’t display any data to non-admin users, the unauthorized access itself poses a security risk. This issue has been addressed in AdminTools version 1.1.

Technical Details

The vulnerability stems from insufficient access control on the AdminTools.SpammedPages page within the XWiki AdminTools application. Prior to version 1.1, the view rights for this page were not exclusively limited to members of the XWikiAdminGroup. This oversight allows any authenticated user to navigate to the page, even though they lack the necessary permissions to view any sensitive data. The mere ability to access an administrative tool, even without data visibility, can provide attackers with valuable information about the system and potentially aid in reconnaissance efforts.

CVSS Analysis

• CVSS Score: 5.3 (Medium)
• CVSS Vector: This information is not available in the provided data. Generally, a CVSS score of 5.3 indicates a vulnerability that might be exploitable with some effort and could have a moderate impact.

Possible Impact

Although the vulnerability doesn’t directly expose sensitive data to unauthorized users, the ability to access administrative pages can have the following impacts:

• Information Disclosure (Indirect): Knowing that the SpammedPages feature exists and is accessible (even without data) can give attackers insight into the system’s configuration and capabilities.
• Reconnaissance: Unauthorized access to administrative interfaces, even with limited functionality, can be a step in a broader reconnaissance effort to identify potential attack vectors.
• Denial of Service (Potential): While not immediately apparent, a determined attacker might find ways to abuse the accessible page to cause a denial of service, though this would likely require additional exploitation.

Mitigation or Patch Steps

The recommended mitigation is to upgrade to XWiki AdminTools version 1.1 or later. If upgrading is not immediately feasible, the following workaround can be applied:

1. Restrict View Rights: Manually configure the view rights for the AdminTools space to only be available to members of the XWikiAdminGroup. This ensures that only administrators can access any page within the AdminTools space, including SpammedPages.

Steps to restrict view rights (general XWiki procedure, may vary slightly based on your specific version):

1. Navigate to the AdminTools space.
2. Access the space’s administration section (often found under “More Actions” or a similar menu).
3. Locate the “Rights” or “Permissions” section.
4. Edit the view rights to explicitly grant view access only to the XWikiAdminGroup. Ensure that all other groups or users have “Deny” permissions for viewing the space.
5. Save the changes.

References

• GitHub Security Advisory: GHSA-v7r8-8p5c-h4xw