GHSA-2g22-wg49-fgv5
XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.xwiki.contrib:macro-fullcalendar-pom | < 2.4.5 | 2.4.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Anyone who has view rights on the `Calendar.JSONService` page, including guest users can exploit this vulnerability by accessing database info or starting a DoS attack.
### Workarounds
Remove the `Calendar.JSONService` page. This will however break some functionalities.
### References
Jira issue:
* [FULLCAL-80: SQL injection through Calendar.JSONService](https://jira.xwiki.org/browse/FULLCAL-80)
* [FULLCAL-81: SQL injection through Calendar.JSONService still exists](https://jira.xwiki.org/browse/FULLCAL-81)
### For more information
If there are any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email [Security Mailing List](mailto:[email protected])
References
External links from the advisory. They lead to third-party sites.