-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.struts:struts2-core | maven | < 2.2.3 | 2.2.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key points: 1) The action name (derived from user-controlled request parameters via DMI) was not properly escaped when retrieved (as shown in WW-3579 JIRA patch modifying DefaultActionProxy), and 2) The error page templates lacked output encoding for action names. The combination allows XSS when invalid actions/methods are requested. The JIRA ticket's patch shows escaping was added to DefaultActionProxy and error templates, confirming these were the vulnerable points.
JavaJavaOngoing coverage of React2Shell