« Volver al listado

CVE-2025-27603

Estado: AplazadaCrítica (9.1)—

XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This vulnerability is fixed in 1.2.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/AC:L/PR:H con ejecución de código arbitrario en servidor remoto sin interacción de usuario. PR:H (privilegios altos) requiere T1210 en lugar de T1190. CWE-95 (eval dinámico) permite ejecutar código arbitrario.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramRestrict Web-Based ContentNetwork Segmentation

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Xwiki — Confluence Migrator PROAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-27603",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-27603",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-07T17:57:15.302395Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "xwikisas",
          "product": "application-confluence-migrator-pro",
          "versions": [
            {
              "status": "affected",
              "version": "> 1.0, < 1.2.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-03-07T16:15:40.037",
  "references": [
    {
      "url": "https://github.com/xwikisas/application-confluence-migrator-pro/commit/36cef2271bd429773698ca3a21e47b6d51d6377d",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/xwikisas/application-confluence-migrator-pro/security/advisories/GHSA-6qvp-39mm-95v8",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/xwikisas/application-confluence-migrator-pro/security/advisories/GHSA-6qvp-39mm-95v8",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-95"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This vulnerability is fixed in 1.2.0."
    },
    {
      "lang": "es",
      "value": "XWiki Confluence Migrator Pro ayuda a los administradores a importar paquetes de Confluence en su instancia de XWiki. Un usuario que no tenga derechos de programación puede ejecutar código arbitrario debido a una traducción sin escape al crear una página utilizando la plantilla Página de migración. Esta vulnerabilidad se solucionó en la versión 1.2.0."
    }
  ],
  "lastModified": "2026-06-17T09:03:53.797",
  "sourceIdentifier": "security-advisories@github.com"
}