-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unencoded URL parameters being reflected in HTML responses. The patch shows two critical changes: 1) Replaced manual angle bracket replacement with HtmlEncode() for JSON output, and 2) Added HtmlEncode() to the URL construction logic. The absence of these encodings in vulnerable versions allowed raw user input from the URL to be rendered in HTML responses. The SerializeToStreamAsync method is directly responsible for HTML response generation, making it the vulnerable entry point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ServiceStack | nuget | >= 4.5.14, < 5.2.0 | 5.2.0 |
C#C#