-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.sling:org.apache.sling.xss | maven | < 1.0.12 | 1.0.12 |
| org.apache.sling:org.apache.sling.xss.compat | maven | < 1.1.0 | 1.1.0 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from the use of an insecure SAX parser in XSS.getValidXML(). The commit diff shows that the SAXParserFactory in XSSAPIImpl.activate() was initially configured without disabling features like external DTDs and entities (CWE-611). The patched version adds these security settings. Since XSS.getValidXML() relies on this factory to create parsers, both the factory initialization (activate) and the validation method (getValidXML) are directly responsible for the XXE vulnerability. The high confidence comes from explicit evidence in the patch and CVE description linking the insecure parser to this method.