VulnerabilityAnalyzed

CVE-2025-65090

Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (including guest users) can exploit the data leak vulnerability by accessing database info, with the exception of passwords.

MEDIUM 5.3EPSS 0.27%

Does this matter?

Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.

Description

XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (including guest users) can exploit the data leak vulnerability by accessing database info, with the exception of passwords. This issue has been patched in version 2.4.6.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.27% probability · 20th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: xwiki/full calendar macro
Source: security-advisories@github.com

References

https://github.com/xwiki-contrib/macro-fullcalendar/commit/25bc14c181c9a92f493b20ac264388c7ba171884Patch
https://github.com/xwiki-contrib/macro-fullcalendar/security/advisories/GHSA-637h-ch24-xp9mThird Party Advisory
https://jira.xwiki.org/browse/FULLCAL-82Permissions Required

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.