CVE-2025-65091 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2025-65091 requires immediate attention.

· 3 min read

```html

Executive Summary

A critical SQL injection vulnerability, identified as CVE-2025-65091, has been discovered in the Maven package org.xwiki.contrib:macro-fullcalendar-pom. This flaw allows any user with view rights on the Calendar.JSONService page, including guest users, to potentially access sensitive database information or initiate a Denial of Service (DoS) attack. Immediate action is required to mitigate risks associated with this vulnerability.

Immediate Action

  • Remove the Calendar.JSONService page to prevent exploitation, understanding this will disable some functionalities.
  • Monitor for any updates from the XWiki team regarding a patched version.
  • Review user permissions to limit access to the Calendar.JSONService page.
  • Consider implementing application firewall rules to block unauthorized access.
  • Stay informed by checking the vendor advisories for updates.

Affected Versions

  • org.xwiki.contrib:macro-fullcalendar-pom@<=1.2.3 vulnerable; upgrade to 1.2.4+

Resolution Guide

To mitigate this vulnerability, you can remove the affected service or upgrade to a safe version once available. Here’s how to do it:

mvn dependency:tree | grep macro-fullcalendar-pom
# Check current version

To upgrade, use:

mvn org.apache.maven.plugins:maven-dependency-plugin:3.1.0:copy-dependencies -DincludeArtifactIds=macro-fullcalendar-pom -DoutputDirectory=libs
# This command copies the dependencies to a local libs directory

For configuration hardening, consider disabling the vulnerable module in your configuration files, if applicable.

Detection & Verification

To check if your application is vulnerable, verify the installed version of the affected package:

mvn dependency:tree | grep macro-fullcalendar-pom
# This will show the current version of the package

To verify the fix, ensure the version is updated:

mvn dependency:tree | grep macro-fullcalendar-pom
# Confirm the upgraded version is now >1.2.4

Risk and Impact

The impact of exploiting this vulnerability can lead to unauthorized access to sensitive database information or service disruption through DoS attacks. The risk is particularly high for applications with guest access enabled, as this allows attackers to exploit the vulnerability without needing authentication.

```

Keep reading