CVE-2025-65090

Description

XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (including guest users) can exploit the data leak vulnerability by accessing database info, with the exception of passwords. This issue has been patched in version 2.4.6.

Risk Information

Base Score

5.3

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Score

Exploitation Probability

0.028

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-65090 are fixed in XWiki - macro-fullcalendar-pom 2.4.6	Windows
Vulnerabilities CVE-2025-65090 are fixed in XWiki - macro-fullcalendar-pom for Linux 2.4.6	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234