-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| edu.stanford.nlp:stanford-corenlp | maven | <= 4.3.0 | 4.3.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from using DocumentBuilderFactory.newInstance() without configuring security features to prevent XXE attacks. The patch introduced a safeDocumentBuilderFactory() method that disables DTDs, external entities, and enables secure processing. All identified functions were directly instantiating DocumentBuilderFactory without these protections in pre-patch versions, making them vulnerable to external entity injection.