-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.jfinal:jfinal | maven | <= 4.9.08 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from JFinal's Redis plugin using JdkSerializer which employs unsafe Java native deserialization. The valueFromBytes method directly calls readObject() on untrusted Redis data. This matches the CWE-502 pattern and is explicitly referenced in the GitHub issue #184 where the researcher demonstrates RCE through crafted Redis entries. The attack vector requires using JdkSerializer configuration with RedisPlugin, making this function the root cause.