| Package | Affected versions | Patched versions |
|---|---|---|
| org.xwiki.contrib:macro-fullcalendar-pom | < 2.4.5 | 2.4.5 |
| full calendar macro | < 2.4.5 | 2.4.5 |
Anyone who has view rights on the Calendar.JSONService page, including guest users can exploit this vulnerability by accessing database info or starting a DoS attack.
Remove the Calendar.JSONService page. This will however break some functionalities.
Jira issue:
If there are any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free