-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.owasp.esapi:esapi | maven | >= 2.0.0, < 2.1.0 | 2.1.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from deprecated encrypt/decrypt methods that didn't enforce MAC validation. The commit removes these methods entirely, with the patch notes explicitly stating this addresses the authenticity bypass. The CipherText.validateMAC() method was modified to return false instead of true when MAC validation failed, but the root cause was the existence of deprecated methods that bypassed these checks entirely. The vulnerable versions (2.0.x) contained these deprecated methods that operated without MAC validation in their default configuration.