-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.splunk.splunkins:splunk-devops | maven | < 1.8.0 | 1.8.0 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stemmed from unsandboxed Groovy compilation in form validation endpoints. The commit diff shows the original validateGroovyScript used GroovyShell directly (vulnerable), while the patched version uses GroovySandbox and ScriptApproval. The doCheckScriptContent method exposed this validation to HTTP endpoints without proper security checks (added RequirePOST and ADMINISTER permission checks in patch). Together these functions formed the attack surface for the sandbox bypass.
Ongoing coverage of React2Shell