-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.struts:struts2-core | maven | < 2.3.20 | 2.3.20 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from ParametersInterceptor's incomplete validation of excluded parameters. The CVE description explicitly states the failure to properly restrict access to the getClass method, which is mapped to ClassLoader manipulation. The S2-021 advisory shows the original regex pattern for excludeParams was missing coverage for all 'class' parameter variants (e.g., variations with brackets, quotes, or case manipulation). The setParameters method executes the vulnerable parameter binding logic, while isExcluded implements the flawed exclusion check. Both functions are core to the parameter handling vulnerability described.