CVE-2025-65091: XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService
Impact
Anyone who has view rights on the Calendar.JSONService page, including guest users can exploit this vulnerability by accessing database info or starting a DoS attack.
Workarounds
Remove the Calendar.JSONService page. This will however break some functionalities.
References
Jira issue: FULLCAL-80: SQL injection through Calendar.JSONService FULLCAL-81: SQL injection through Calendar.JSONService still exists
For more information
If there are any questions or comments about this advisory: Open an issue in Jira XWiki.org Email Security Mailing List
Other sources
XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (including guest users) can exploit a SQL injection vulnerability by accessing database info or starting a DoS attack. This issue has been patched in version 2.4.5.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65091?
CVE-2025-65091 is considered a high severity vulnerability due to its potential for data exposure and Denial of Service attacks.
How do I fix CVE-2025-65091?
To mitigate CVE-2025-65091, you can remove the Calendar.JSONService page, though this may affect some functionalities.
Who is affected by CVE-2025-65091?
Any user with view rights on the Calendar.JSONService page, including guest users, is affected by CVE-2025-65091.
What type of attack can CVE-2025-65091 enable?
CVE-2025-65091 can enable unauthorized access to database information or facilitate a Denial of Service attack.
Which software versions are affected by CVE-2025-65091?
CVE-2025-65091 affects versions of the macro-fullcalendar-pom package up to and including 2.4.3.