xwiki-contrib/macro-fullcalendar · Security
XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService
- GHSA ID
- GHSA-637h-ch24-xp9m
- CVE ID
- CVE-2025-65090
- Severity
- medium
- Published
- Updated
- CVSS
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
Impact
Anyone who has view rights on the Calendar.JSONService page, including guest users can exploit this vulnerability by accessing database info, with the exception of passwords.
Workarounds
Remove the Calendar.JSONService page. This will however break some functionalities.
References
Jira issue:
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki.org
- Email us at Security Mailing List
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
References
- https://github.com/xwiki-contrib/macro-fullcalendar/security/advisories/GHSA-637h-ch24-xp9m ↗
- https://github.com/xwiki-contrib/macro-fullcalendar/commit/25bc14c181c9a92f493b20ac264388c7ba171884 ↗
- https://jira.xwiki.org/browse/FULLCAL-82 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2025-65090 ↗
- https://github.com/advisories/GHSA-637h-ch24-xp9m ↗