-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cgi | rubygems | >= 0.3.0, < 0.3.5 | 0.3.5 |
| cgi | rubygems | >= 0.2.0, < 0.2.2 | 0.2.2 |
| cgi | rubygems | < 0.1.0.2 | 0.1.0.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper neutralization of CRLF sequences in HTTP headers. The CGI::Cookie#initialize method handles cookie attributes, and the advisory specifically mentions cookie object creation as a vector. The CGI#header method directly constructs HTTP headers, making it a prime candidate for injection if input isn't sanitized. Both functions were patched in the fixed versions to add proper validation/escaping, confirming their role in the vulnerability.
Ongoing coverage of React2Shell