-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper path validation in the MultipartPortlet's file upload handler. The exploit demonstrates attackers can manipulate the 'filename' parameter to perform directory traversal (e.g., 'filename="../../../webapps/pluto/jspshell.jsp"'). This indicates the function responsible for processing uploaded files uses unsanitized user input to construct file paths. The PortletV3AnnotatedDemo's MultipartPortlet would logically contain the file upload handling code, and the processAction method (common in portlet lifecycle) would be where uploads are processed. The lack of path normalization/sanitization in this function matches the described CWE-200 exposure mechanism.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.portals.pluto:pluto-container | maven | = 3.0.0 | 3.0.1 |