-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation in JMSSource's configuration handling. The commit diff shows the addition of URI scheme validation for the 'connectionFactory' parameter, which was previously missing. The vulnerable versions lacked checks to restrict JNDI URIs to 'java' protocol or no protocol, allowing LDAP-based attacks. The test case added in the patch demonstrates rejection of 'ldap://' URIs, confirming the attack vector was through this configuration parameter processing path.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.flume.flume-ng-sources:flume-jms-source | maven | >= 1.4.0, < 1.10.0 | 1.10.0 |