-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| silverstripe/framework | composer | >= 4.0.0, < 4.4.7 | 4.4.7 |
| silverstripe/framework | composer | >= 4.5.0, < 4.5.4 | 4.5.4 |
| silverstripe/framework | composer | >= 3.0.0, < 3.7.5 | 3.7.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from three attack vectors: 1) _method POST parameter handling, 2) X-HTTP-Method-Override header, and 3) X-Original-Url header. The patch removes these features. The detect_method() function explicitly handled method override logic through POST parameters, while cleanEnvironment() processed the dangerous headers. Both functions created inconsistencies between actual requests and their interpreted versions, enabling cache poisoning through smuggled HTTP methods and URLs.
PHPPHPOngoing coverage of React2Shell