Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.xwiki.contrib.jira:jira-macro-default

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.7MavenPublished

    The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server

    CVE-2025-31487 · GHSA-wc53-4255-gw3f

    Affected
    • Maven org.xwiki.contrib.jira:jira-macro-default >= 4.2, < 8.5.6
    Fixed in
    8.5.6· Vendor fix available
    Issue
    Impact If the JIRA macro is installed, any logged in XWiki user could edit his/her user profile wiki page and use that JIRA macro, specifying a fake JIRA URL that returns an XML specifying a DOCTYPE pointing to a local file on the XWiki server host and displaying that file's content in one of the returned JIRA fields (such as the summary or description for example). For example: Patches The vulnerability has been patched in the JIRA Extension v8.6.5. Workarounds No easy workaround except to upgrade (which is easy using the XWiki Extension Manager). References https://github.com/xwiki-contrib/jira/commit/98a74c2a516b42689c73b13ecd94e9c1998fa9cb and https://github.com/xwiki-contrib/jira/commit/5049e352d16f8356734de70daf1202301f170ee6 https://jira.xwiki.org/browse/JIRA-49 For more information If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List

    Recommended action: Upgrade to 8.5.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →