From 410bfbc4a038941ed8e80b9789729d17a8e863a0 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 29 Apr 2025 14:03:23 +0000
Subject: [PATCH] Publish GHSA-rp38-24m3-rx87

---
 .../GHSA-rp38-24m3-rx87.json                  | 103 ++++++++++++++++++
 1 file changed, 103 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/04/GHSA-rp38-24m3-rx87/GHSA-rp38-24m3-rx87.json

diff --git a/advisories/github-reviewed/2025/04/GHSA-rp38-24m3-rx87/GHSA-rp38-24m3-rx87.json b/advisories/github-reviewed/2025/04/GHSA-rp38-24m3-rx87/GHSA-rp38-24m3-rx87.json
new file mode 100644
index 00000000000..499dbb07779
--- /dev/null
+++ b/advisories/github-reviewed/2025/04/GHSA-rp38-24m3-rx87/GHSA-rp38-24m3-rx87.json
@@ -0,0 +1,103 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-rp38-24m3-rx87",
+  "modified": "2025-04-29T14:01:48Z",
+  "published": "2025-04-29T14:01:47Z",
+  "aliases": [
+    "CVE-2025-32972"
+  ],
+  "summary": "The lesscss script service allows cache clearing without programming right",
+  "details": "### Impact\nThe script API of the LESS compiler in XWiki is incorrectly checking for rights when calling the cache cleaning API, making it possible to clean the cache without having programming right. The only impact of this is a slowdown in XWiki execution as the caches are re-filled. As this vulnerability requires script right to exploit, and script right already allows unlimited execution of scripts, the additional impact due to this vulnerability is low.\n\n### Patches\nThis has been patched in XWiki 15.10.12, 16.4.3 and 16.8.0 RC1.\n\n### Workarounds\nWe're not aware of any workaround except for being careful whom to give script right, which is a general recommendation.\n\n### References\n* https://jira.xwiki.org/browse/XWIKI-22462\n* https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.xwiki.platform:xwiki-platform-lesscss-script"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "6.1-milestone-1"
+            },
+            {
+              "fixed": "15.10.12"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.xwiki.platform:xwiki-platform-lesscss-script"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "16.0.0-rc-1"
+            },
+            {
+              "fixed": "16.4.3"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.xwiki.platform:xwiki-platform-lesscss-script"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "16.5.0-rc-1"
+            },
+            {
+              "fixed": "16.8.0-rc-1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rp38-24m3-rx87"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/xwiki/xwiki-platform/commit/91752122d8782f171f8728004a57bdaefc34253e"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/xwiki/xwiki-platform"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jira.xwiki.org/browse/XWIKI-22462"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-285"
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-29T14:01:47Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file