-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mautic/core | composer | >= 1.0.0-beta2, < 4.4.12 | 4.4.12 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from using 'html' sanitization mode in CleanFormSubscriber for description fields across multiple form types. This mode allowed dangerous HTML elements/attributes while storing user input. The patch consistently changes these to 'strict_html' (seen in commit diffs), which implements safer filtering. The buildForm methods in various FormType classes that initialized CleanFormSubscriber with ['description' => 'html'] were the root cause, as evidenced by their modification in the security patch. High confidence comes from the direct correlation between the parameter change and XSS mitigation shown in the test cases.
PHPPHPOngoing coverage of React2Shell