CVE-2025-27604: 
Java vulnerability analysis and mitigation

CVE-2025-27604 affects XWiki Confluence Migrator Pro, a tool that helps administrators import confluence packages into their XWiki instance. The vulnerability was discovered on March 7, 2025, and affects versions up to 1.11.6, with a fix released in version 1.11.7. The issue stems from the application's homepage being publicly accessible, which could expose sensitive information to unauthorized users (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, requires no user interaction, has unchanged scope, and can result in high confidentiality impact without affecting integrity or availability (GitHub Advisory).

The primary impact of this vulnerability is the potential exposure of sensitive information. Since the application's homepage is publicly accessible, any guest user can download packages that might contain confidential data (GitHub Advisory).

The vulnerability is easily exploitable as it requires no special privileges, user interaction, or complex attack methods. Any unauthenticated user can access the public homepage and potentially download sensitive information (GitHub Advisory).

The vulnerability has been fixed in version 1.11.7 of XWiki Confluence Migrator Pro. As a workaround, administrators can manually restrict access to the page to specific users or groups if they cannot immediately upgrade (GitHub Advisory).