CVEvulnerability

CVE-2025-65090

5.3 MEDIUM Published 2026-01-10 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2026-01-10
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses: CWE-200

Description

XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (including guest users) can exploit the data leak vulnerability by accessing database info, with the exception of passwords. This issue has been patched in version 2.4.6.

Affected configurations

• xwiki full calendar macro (< 2.4.6)

Weakness · CWE (1)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References

https://github.com/xwiki-contrib/macro-fullcalendar/commit/25bc14c181c9a92f493b20ac264388c7ba171884 Patch
https://github.com/xwiki-contrib/macro-fullcalendar/security/advisories/GHSA-637h-ch24-xp9m Third Party Advisory
https://jira.xwiki.org/browse/FULLCAL-82 Permissions Required

CVE-2025-65090

Description

Affected configurations

Related

Weakness · CWE (1)

References