icon

We found results for “

CVE-2025-31487

Good to know:

icon

Date: April 3, 2025

The XWiki JIRA extension provides various integration points between XWiki and JIRA (macros, UI, CKEditor plugin). If the JIRA macro is installed, any logged in XWiki user could edit his/her user profile wiki page and use that JIRA macro, specifying a fake JIRA URL that returns an XML specifying a DOCTYPE pointing to a local file on the XWiki server host and displaying that file's content in one of the returned JIRA fields (such as the summary or description for example). The vulnerability has been patched in the JIRA Extension v8.6.5.

Severity Score

Severity Score

Weakness Type (CWE)

Improper Restriction of XML External Entity Reference

CWE-611

Top Fix

icon

Upgrade Version

Upgrade to version org.xwiki.contrib.jira:jira-macro-default:8.6.5;https://github.com/xwiki-contrib/jira.git - jira-8.6.5

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us