| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.contrib:macro-fullcalendar-pom | < 2.4.6 | 2.4.6 |
| full calendar macro | < 2.4.6 | 2.4.6 |
Anyone who has view rights on the Calendar.JSONService page, including guest users can exploit this vulnerability by accessing database info, with the exception of passwords.
Remove the Calendar.JSONService page. This will however break some functionalities.
Jira issue:
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free