Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.xwiki.platform:xwiki-platform-lesscss-script

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 2.7MavenPublished

    The lesscss script service allows cache clearing without programming right

    CVE-2025-32972 · GHSA-rp38-24m3-rx87

    Affected
    • Maven org.xwiki.platform:xwiki-platform-lesscss-script >= 6.1-milestone-1, < 15.10.12; >= 16.0.0-rc-1, < 16.4.3; >= 16.5.0-rc-1, < 16.8.0-rc-1
    Fixed in
    16.4.316.8.0-rc-115.10.12· Vendor fix available
    Issue
    Impact The script API of the LESS compiler in XWiki is incorrectly checking for rights when calling the cache cleaning API, making it possible to clean the cache without having programming right. The only impact of this is a slowdown in XWiki execution as the caches are re-filled. As this vulnerability requires script right to exploit, and script right already allows unlimited execution of scripts, the additional impact due to this vulnerability is low. Patches This has been patched in XWiki 15.10.12, 16.4.3 and 16.8.0 RC1. Workarounds We're not aware of any workaround except for being careful whom to give script right, which is a general recommendation.

    Recommended action: Upgrade to 16.8.0-rc-1 (pre-release), 16.4.3 or 15.10.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →