-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.zkoss.zk:zk | maven | < 8.6.4.2 | 8.6.4.2 |
| org.zkoss.zk:zk | maven | >= 9.0.0.0, < 9.0.1.3 | 9.0.1.3 |
| org.zkoss.zk:zk | maven | >= 9.5.0.0, < 9.5.1.4 | 9.5.1.4 |
| org.zkoss.zk:zk | maven | >= 9.6.0.0, < 9.6.0.2 | 9.6.0.2 |
| org.zkoss.zk:zk | maven | >= 9.6.1, < 9.6.2 | 9.6.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of the 'nextURI' parameter in AuUploader and AuDropUploader servlets. The patch removes all references to 'nextURI' parameter processing and hardcodes the forward destination, indicating that user-controlled URI redirection was the root cause. The CVE description explicitly mentions exploitation via crafted POST requests to AuUploader, and the commit diff shows removal of 'nextURI' handling in both classes' service methods. This parameter allowed attackers to force the server to forward requests to internal resources like WEB-INF files.