VYPR
← All advisories
High severity7.7NVD Advisory· Published Apr 3, 2025· Updated Apr 15, 2026

CVE-2025-31487

CVE-2025-31487

Description

The XWiki JIRA extension provides various integration points between XWiki and JIRA (macros, UI, CKEditor plugin). If the JIRA macro is installed, any logged in XWiki user could edit his/her user profile wiki page and use that JIRA macro, specifying a fake JIRA URL that returns an XML specifying a DOCTYPE pointing to a local file on the XWiki server host and displaying that file's content in one of the returned JIRA fields (such as the summary or description for example). The vulnerability has been patched in the JIRA Extension v8.6.5.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.xwiki.contrib.jira:jira-macro-defaultMaven
>= 4.2, < 8.5.68.5.6

Patches

2
5049e352d16f

JIRA-49: Don't access DTDs or Schemas

https://github.com/xwiki-contrib/jiraVincent MassolNov 3, 2022via ghsa
commit
2 files changed · +3 −10
  • jira-macro/jira-macro-default/pom.xml+0 −6 modified
    @@ -103,12 +103,6 @@
       <artifactId>xwiki-rendering-test</artifactId>
       <version>${rendering.version}</version>
       <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <groupId>xerces</groupId>
-          <artifactId>xercesImpl</artifactId>
-        </exclusion>
-      </exclusions>
     </dependency>
     <dependency>
       <groupId>com.github.tomakehurst</groupId>
  • jira-macro/jira-macro-default/src/main/java/org/xwiki/contrib/jira/macro/internal/source/HTTPJIRAFetcher.java+3 −4 modified
    @@ -23,7 +23,6 @@
 import java.net.URL;
 
 import javax.inject.Singleton;
-import javax.xml.XMLConstants;
 
 import org.apache.commons.lang3.StringUtils;
 import org.apache.http.HttpEntity;
@@ -134,9 +133,9 @@ private SAXBuilder createSAXBuilder()
     {
         // Note: SAXBuilder is not thread-safe which is why we're instantiating a new one every time.
         SAXBuilder builder = new SAXBuilder();
-        // Note: Prevent XXE attacks
-        builder.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
-        builder.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
+        // Note: Prevent XXE attacks by disabling completely DTDs. This is possible since JIRA returns an XML content
+        // that doesn't use a DTD.
+        builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
         return builder;
     }
 }
98a74c2a516b

JIRA-49: Don't access DTDs or Schemas

https://github.com/xwiki-contrib/jiraVincent MassolNov 3, 2022via ghsa
commit
2 files changed · +12 −1
  • jira-macro/jira-macro-default/pom.xml+6 −0 modified
    @@ -103,6 +103,12 @@
       <artifactId>xwiki-rendering-test</artifactId>
       <version>${rendering.version}</version>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <groupId>xerces</groupId>
+          <artifactId>xercesImpl</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>com.github.tomakehurst</groupId>
  • jira-macro/jira-macro-default/src/main/java/org/xwiki/contrib/jira/macro/internal/source/HTTPJIRAFetcher.java+6 −1 modified
    @@ -23,6 +23,7 @@
 import java.net.URL;
 
 import javax.inject.Singleton;
+import javax.xml.XMLConstants;
 
 import org.apache.commons.lang3.StringUtils;
 import org.apache.http.HttpEntity;
@@ -132,6 +133,10 @@ protected HttpClientBuilder createHttpClientBuilder(JIRAServer jiraServer)
     private SAXBuilder createSAXBuilder()
     {
         // Note: SAXBuilder is not thread-safe which is why we're instantiating a new one every time.
-        return new SAXBuilder();
+        SAXBuilder builder = new SAXBuilder();
+        // Note: Prevent XXE attacks
+        builder.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+        builder.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
+        return builder;
     }
 }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.