-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped rendering of HTTP parameters in setup-datasource-standard.jsp. The patch adds JSTL escaping (fn:escapeXml) to all user-controlled input fields. In JSP architecture, the _jspService method of the compiled servlet handles parameter rendering. The vulnerable version used scriptlets (<%= ... %>) without escaping, while the patched version uses safe output encoding. This function would appear in runtime traces during parameter processing and response generation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.igniterealtime.openfire:parent | maven | < 4.4.2 | 4.4.2 |