XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService

Impact

Anyone who has view rights on the Calendar.JSONService page, including guest users can exploit this vulnerability by accessing database info, with the exception of passwords.

Workarounds

Remove the Calendar.JSONService page. This will however break some functionalities.

References

Jira issue:

• FULLCAL-82: Calendar.JSONService exposes emails of all users

For more information

If you have any questions or comments about this advisory:

• Open an issue in Jira XWiki.org
• Email us at Security Mailing List