How severe is CVE-2025-32973?

This vulnerability has a severity rating of CRITICAL with a CVSS score of 9 out of 10.

What type of vulnerability is CVE-2025-32973?

This is classified as CWE-862, which is a common weakness in software security.

CVE-2025-32973 - CRITICAL Severity | CVSS 9

Vulnerability Description

XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, when a user with programming rights edits a document in XWiki that was last edited by a user without programming rights and contains an XWiki.ComponentClass, there is no warning that this will grant programming rights to this object. An attacker who created such a malicious object could use this to gain programming rights on the wiki. For this, the attacker needs to have edit rights on at least one page to place this object and then get an admin user to edit that document. This issue has been patched in versions 15.10.12, 16.4.3, and 16.8.0-rc-1.

Related Vulnerabilities

CVE-2018-10866

CRITICAL

CVSS:9.1(Critical)

It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to remove a "system" file, that is an xml file wi...

CWE-8622018

CVE-2018-7702

CRITICAL

CVSS:9.1(Critical)

SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e-mail messages to arbitrary recipients, or modify arbitrary message bodies and a...

CWE-8622018

CVE-2019-18581

CRITICAL

CVSS:9.1(Critical)

Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server missing authorization vulnerability in the REST API. A re...

CWE-8622019

CVE-2019-19885

CRITICAL

CVSS:9.1(Critical)

In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data without prior authorizatio...

CWE-8622019

CVE-2020-19038

CRITICAL

CVSS:9.1(Critical)

File Deletion vulnerability in Halo 0.4.3 via delBackup.

CWE-8622020

CVE-2020-1963

CRITICAL

CVSS:9.1(Critical)

Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem.

CWE-8622020