-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| centreon/centreon | composer | >= 19.10.0, < 19.10.7 | 19.10.7 |
| centreon/centreon | composer | >= 19.0.0, < 19.04.10 | 19.04.10 |
| centreon/centreon | composer | >= 18.0.0, < 18.10.11 | 18.10.11 |
| centreon/centreon | composer | < 2.8.32 | 2.8.32 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stemmed from session IDs being embedded in server responses through multiple pathways. Key evidence comes from the patch diffs showing removal of sid parameters from: 1) JavaScript function signatures (initM/goM), 2) XML output generation, 3) URL construction logic. These functions directly handled session identifiers and exposed them in HTTP responses, enabling session hijacking. The systematic removal of sid references in the patch confirms these were the exposure points.
Ongoing coverage of React2Shell