-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.alluxio:alluxio-parent | maven | <= 1.8.1 |
Miggo AIRoot Cause AnalysisThe vulnerability manifests in the handling of the 'path' parameter within the browse functionality. The GitHub issue (#10552) demonstrates that unescaped user input from the URL parameter is reflected in the HTML response. In Java web applications using servlets, this typically occurs when request parameters are directly written to the response stream without using output encoding methods like ESAPI.encoder().encodeForHTML(). The WebInterfaceBrowseServlet would be responsible for rendering the browse interface and processing the 'path' parameter, making it the most likely location for missing sanitization logic.
JavaJavaOngoing coverage of React2Shell