-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe patch modifies HttpServer.java's handlePluginSite method where plugin file requests are handled. The vulnerability stemmed from: 1) Initial insufficient path validation using String.startsWith() without normalization 2) Missing protection against path traversal sequences before file access. The exploit would manifest here as this method processes '_plugin/' URLs, and the added test cases in SitePluginTests.java validate that this was the attack vector. The function signature matches the code location where malicious paths would be processed during exploitation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.elasticsearch:elasticsearch | maven | <= 1.4.4 | 1.4.5 |
| org.elasticsearch:elasticsearch | maven | >= 1.5.0, <= 1.5.1 | 1.5.2 |
JavaJavaOngoing coverage of React2Shell