GitHub Advisoryadvisory · Maven

GHSA-3w9f-2pph-j5vc com.xwiki.confluencepro:application-confluence-migrator-pro-ui's application homepage is public

HIGH Published 2025-03-07 Modified 2025-03-07 Official page ↗
Aliases
CVE-2025-27604
Ecosystem
Maven
Packages
com.xwiki.confluencepro:application-confluence-migrator-pro-ui
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2025-03-07

Affected packages

• Maven com.xwiki.confluencepro:application-confluence-migrator-pro-ui: < 1.11.7 → fixed in 1.11.7

Description

Impact The homepage of the application is public which enables a guest to download the package which might contain sensitive information. Patches 1.11.7 Workarounds The access to the page can be manually restricted to a specific set of users or groups.

Related

Alias · CVE (1)

  • CVE-2025-27604 XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References