XWiki Full Calendar Macro SQL Injection Vulnerability in Calendar.JSONService

A SQL injection vulnerability has been identified in the XWiki Full Calendar Macro, affecting versions through 2.4.3. The issue arises in the Calendar.JSONService page, where users with view rights, including guest users, can exploit the vulnerability to access database information or initiate a denial-of-service attack. The vulnerability has been patched in version 2.4.5.

Impact

Exploitation of this vulnerability allows for SQL injection, with the potential to access database information or cause a denial-of-service condition.

Remediation

Users can upgrade to XWiki Full Calendar Macro version 2.4.5 or later to address this vulnerability. Alternatively, the Calendar.JSONService page can be removed, although this may disrupt certain functionalities.