-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.directwebremoting:dwr | maven | < 2.0.11 | 2.0.11 |
| org.directwebremoting:dwr | maven | >= 3.0.M1, <= 3.0.RC2 | 3.0.RC3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from XML external entity processing in four specific converter classes as explicitly named in all authoritative sources (CVE, GHSA, JVN). These converters handle DOM data parsing without proper XXE safeguards. Runtime exploitation would show these converter classes in stack traces when processing malicious XML payloads. The confidence is high due to direct attribution in vulnerability reports, though exact method names within these classes aren't specified in available data.
JavaJavaOngoing coverage of React2Shell