-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.axis2.wso2:axis2 | maven | < 1.5.2 | 1.5.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper DTD handling in XML parsing. Analysis of JIRA AXIS2-4450 and Geronimo security reports shows the root cause was in message builders (SOAPMessageBuilder) and Axiom's StAX parser initialization (StAXOMBuilder). These components processed XML without disabling DTD support, allowing entity expansion attacks. The patch would have modified these areas to set XMLInputFactory.SUPPORT_DTD=false and XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES=false when creating parsers.
A Semantic Attack on Google Gemini - Read the Latest Research