-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-index-ui | maven | >= 2.2-milestone-1, < 13.10.6 | 13.10.6 |
| org.xwiki.platform:xwiki-platform-index-ui | maven | >= 14.0, < 14.3 | 14.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unescaped DOM manipulation in the displayEntry function. The commit diff shows the fix adds .escapeHTML() to row.filename, row.title, row.date, and row.deletername - all user-controlled values. These values were directly injected into Element.update() calls without sanitization, enabling XSS when rendering the deleted attachments list. The function's role in rendering untrusted data and the explicit patching pattern confirm its vulnerability.
Ongoing coverage of React2Shell