{"action":"Upgrade org.xwiki.contrib.jira:jira-macro-default to 8.5.6 or later.","affected":[{"fixed":"8.5.6","introduced":"4.2"}],"component":"org.xwiki.contrib.jira:jira-macro-default","cve_ids":["CVE-2025-31487"],"ecosystem":"Maven","epss":0.00399,"exploited":false,"fixed_versions":["8.5.6"],"ghsa_id":"GHSA-wc53-4255-gw3f","id":"tcs_01M5N9G2VFF8M3KM7BR41PSAF1","modified_at":"2025-04-04T14:20:18Z","published_at":"2025-04-04T14:20:18Z","references":["https://osv.dev/vulnerability/GHSA-wc53-4255-gw3f","https://github.com/xwiki-contrib/jira/security/advisories/GHSA-wc53-4255-gw3f","https://nvd.nist.gov/vuln/detail/CVE-2025-31487","https://github.com/xwiki-contrib/jira/commit/5049e352d16f8356734de70daf1202301f170ee6","https://github.com/xwiki-contrib/jira/commit/98a74c2a516b42689c73b13ecd94e9c1998fa9cb","https://github.com/xwiki-contrib/jira","https://jira.xwiki.org/browse/JIRA-49"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"GHSA-wc53-4255-gw3f","url":"https://osv.dev/vulnerability/GHSA-wc53-4255-gw3f"}],"summary":"The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server"}