-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from the Publisher node's ability to make arbitrary outbound HTTP requests via the endpoint validation feature. The validate()-endpoint API (referenced in product-apim#7677) directly executes HEAD requests using user-controlled 'endpointUrl' parameters without network layer restrictions. This matches the SSRF pattern described in CWE-918 and aligns with the advisory's mention of improper outbound access control in the Publisher component.
Ongoing coverage of React2Shell
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.wso2.am:am-parent | maven | <= 3.0.0 |