-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-security | maven | >= 5.0, < 12.10.11 | 12.10.11 |
| org.xwiki.platform:xwiki-platform-security | maven | >= 13.0, < 13.4.6 | 13.4.6 |
| org.xwiki.platform:xwiki-platform-security | maven | >= 13.10, < 13.10.1 | 13.10.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper cache key generation in the security component, where document and space references with identical names shared the same cache entry. The SecurityCache.getKey function is the most logical candidate for this flaw, as it would be responsible for generating unique identifiers for cached security rules. The description explicitly mentions the cache storage collision between document and space rules, which aligns with a missing entity-type distinction in cache key generation. While exact code references are unavailable, the security cache component and key generation logic are central to the described vulnerability mechanism.
JavaJavaOngoing coverage of React2Shell