-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped output of user-controlled input fields in JSP rendering. While no direct code patches are shown, the exploit documentation and Apache's security advisory confirm the attack vector involves JSPs that display chat messages without proper encoding. The _jspService method in JSP-compiled servlets handles output generation, making it the runtime-visible function when malicious payloads are rendered.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.portals.pluto:chatRoomDemo | maven | >= 3.0.0, < 3.1.0 | 3.1.0 |