-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe patch adds @ResponseBody annotations to exception handlers in RestControllerBase. This indicates the vulnerability stemmed from improper response formatting in error handling. Attackers could trigger these exceptions with malicious input during site creation operations, causing the system to return unescaped XML responses. The missing annotations likely allowed raw error data to be interpreted as XML, enabling XML injection attacks. All four exception handlers would appear in runtime profiles when attackers trigger exceptions through crafted site creation requests.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.craftercms:crafter-core | maven | >= 3.0.0, < 3.0.1 | 3.0.1 |
JavaJavaOngoing coverage of React2Shell