Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
XWikiplatform Allocation of Resources Without Limits or Throttling Vulnerability - CVE-2025-66473 - Vulnerability Database
XWikiplatform

XWikiplatform Allocation of Resources Without Limits or Throttling Vulnerability - CVE-2025-66473

High
Reference: CVE-2025-66473
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2025-66473
Title: XWikiplatform Allocation of Resources Without Limits or Throttling Vulnerability
Overview:

XWiki is an open-source wiki software platform. Versions 16.10.10 and below 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API which doesn39t enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of pages in the wiki and the memory configuration this can lead to slowness and unavailability of the wiki. As an example the /rest/wikis/xwiki/spaces resource returns all spaces on the wiki by default which are basically all pages. This issue is fixed in versions 17.4.4 and 16.10.11.