CVE-2025-31487
Last modified
CVE-2025-31487 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. The XWiki JIRA extension provides various integration points between XWiki and JIRA (macros, UI, CKEditor plugin). If the JIRA macro is installed, any logged in XWiki user could edit his/her user profile wiki page and use that JIRA macro, specifying a fake JIRA URL that returns an XML specifying a DOCTYPE pointing to a local file on the XWiki server host and displaying that file's content in one of the returned JIRA fields (such as the summary or description for example). EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
The XWiki JIRA extension provides various integration points between XWiki and JIRA (macros, UI, CKEditor plugin). If the JIRA macro is installed, any logged in XWiki user could edit his/her user profile wiki page and use that JIRA macro, specifying a fake JIRA URL that returns an XML specifying a DOCTYPE pointing to a local file on the XWiki server host and displaying that file's content in one of the returned JIRA fields (such as the summary or description for example). The vulnerability has been patched in the JIRA Extension v8.6.5.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-31487?
How severe is CVE-2025-31487?
How do I fix CVE-2025-31487?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-31481API Platform Core is a system to create hypermedia-driven RE…7.5
- CVE-2025-31482FreshRSS is a self-hosted RSS feed aggregator. A vulnerabili…4.3
- CVE-2025-31483Miniflux is a feed reader. Due to a weak Content Security Po…4.8
- CVE-2025-31484conda-forge infrastructure holds common configurations and s…9.3
- CVE-2025-31485API Platform Core is a system to create hypermedia-driven RE…7.5
- CVE-2025-31486Vite is a frontend tooling framework for javascript. The con…5.3
- CVE-2025-31488Plain Craft Launcher (PCL) is a launcher for Minecraft. PCL …4.9
- CVE-2025-31489MinIO is a High Performance Object Storage released under GN…8.7
- CVE-2025-3149A vulnerability was found in itning Student Homework Managem…4.8
- CVE-2025-31490AutoGPT is a platform that allows users to create, deploy, a…7.5
- CVE-2025-31491AutoGPT is a platform that allows users to create, deploy, a…8.6
- CVE-2025-31492mod_auth_openidc is an OpenID Certified authentication and a…8.2
Are you affected by CVE-2025-31487?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST