XWiki Full Calendar Macro Data Leak Vulnerability in Calendar.JSONService

A data leak vulnerability has been identified in the XWiki Full Calendar Macro, affecting versions through 2.4.5. The issue arises in the Calendar.JSONService, where users with view rights, including guest users, can access database information, excluding passwords. This vulnerability has been patched in version 2.4.6.

Impact

Exploitation of this vulnerability allows unauthorized access to database information through the Calendar.JSONService, potentially exposing sensitive data such as email addresses, according to the XWiki Jira.

Remediation

Users can upgrade to XWiki Full Calendar Macro version 2.4.6 or later to address this vulnerability. Alternatively, the Calendar.JSONService page can be removed, although this may disrupt certain functionalities.