-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.commons:commons-configuration2 | maven | >= 2.4, < 2.8.0 | 2.8.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from default enabled Lookup interpolators. ConfigurationInterpolator.getDefaultPrefixLookups() is explicitly mentioned in the JIRA CONFIGURATION-753 fix notes as the method that initialized dangerous lookups. DefaultPrefixLookups.values() contains the enum entries for the problematic interpolators (script, dns, url). Version 2.8.0 patched this by removing these from default initialization, confirming these functions' role in the vulnerability.