-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-administration-ui | maven | >= 3.1-milestone-1, <= 13.0 | 13.1RC1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the ResetPassword feature's use of programming rights during user profile saves. The commit diff shows the patched version replaced 'saveWithProgrammingRights()' with 'saveAsAuthor()', indicating this was the vulnerable method. When combined with user-controlled Groovy scripts in profiles, this function enabled privilege escalation by executing untrusted code with system-level permissions during the password reset operation.
JavaJavaOngoing coverage of React2Shell