-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
Miggo AIRoot Cause AnalysisThe vulnerability stems from the unescaped use of window.location.href in the client-side JavaScript code to populate HTML content. The original code concatenated window.location.href with 'ejb' and injected it directly into the DOM via .html(), making it susceptible to XSS via crafted URLs. The patch replaced href with origin+pathname to exclude potentially malicious URL fragments. The code block in app.js's document ready handler that handles server status display is the clear vulnerable location.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tomee:tomee-webapp | maven | < 7.0.5 | 7.0.5 |