CVE-2025-27604

HIGH

XWiki Confluence Migrator Pro < 1.11.7 - Unauthenticated Exposure of Sensitive Information via Public Homepage

Title source: llm
STIX 2.1

Description

XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7.

References (2)

Core 2

Scores

CVSS v3 7.5
EPSS 0.0059
EPSS Percentile 69.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (2)
com.xwiki.confluencepro/application-confluence-migrator-pro-ui 0 - 1.11.7Maven
xwiki/confluence_migrator < 1.11.7
Published Mar 07, 2025
Tracked Since Feb 18, 2026