-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
C#C#Miggo AIRoot Cause AnalysisThe vulnerability stemmed from missing header sanitization in two key areas: 1) When initially reading headers for transactions (WebRequestTransactionCreator.GetHeaders and ElasticApmModule.ConvertHeaders), and 2) When handling error contexts (Error class). The patch added WildcardMatcher checks in these locations and introduced the ErrorContextSanitizerFilter. The vulnerable functions directly handled header data without these sanitization checks prior to 1.10.0, matching the CWE-200/CWE-532 exposure described in the advisory.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Elastic.Apm | nuget | < 1.10.0 | 1.10.0 |
Ongoing coverage of React2Shell