CVE-2025-31487
1 advisory.
Maven/org.xwiki.contrib.jira:jira-macro-default CVE-2025-31487: high 7.7
The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server
Action: Upgrade org.xwiki.contrib.jira:jira-macro-default to 8.5.6 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.2 | 8.5.6 | - |
Fixed versions
| 8.5.6 |
Sources
- osv: GHSA-wc53-4255-gw3f
- https://github.com/xwiki-contrib/jira/security/advisories/GHSA-wc53-4255-gw3f
- https://nvd.nist.gov/vuln/detail/CVE-2025-31487
- https://github.com/xwiki-contrib/jira/commit/5049e352d16f8356734de70daf1202301f170ee6
- https://github.com/xwiki-contrib/jira/commit/98a74c2a516b42689c73b13ecd94e9c1998fa9cb
- https://github.com/xwiki-contrib/jira
- https://jira.xwiki.org/browse/JIRA-49
CVE-2025-31487 · published · modified · JSON