-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.activemq:activemq-client | maven | >= 5.0.0, < 5.10.1 | 5.10.1 |
| org.apache.activemq:activemq-broker | maven | >= 5.0.0, < 5.10.1 | 5.10.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsafe XML parsing in XPath selector handling. The pre-patch code in both evaluator classes directly processed XML messages using XPath evaluation on raw InputSource streams without disabling external entity resolution. The commit introduced a properly configured DocumentBuilder with security features (disabling external entities/DTDs) to mitigate XXE. The vulnerable functions are the evaluate() methods that previously lacked these safeguards, as confirmed by the patch's focus on adding DocumentBuilder-based parsing.