-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.jspwiki:jspwiki-main | maven | < 2.11.3 | 2.11.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the DenouncePlugin's handling of user-controlled URLs, as explicitly referenced in both CVE descriptions. The AJAXPreview.jsp endpoint is the attack vector, but the root cause is the plugin's rendering logic. The previous CVE-2021-40369 involved similar insufficient sanitization in this plugin, and the advisory confirms the patch was incomplete. While exact code isn't available, the pattern matches classic XSS vulnerabilities in plugin rendering methods that handle untrusted input without proper escaping.