-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability combines HTML injection (CWE-79) with path traversal (CWE-22) via the /management/users/register endpoint. The UserRegistrationController handles user registration requests, and the EmailService processes email templates. Previous CVE-2019-25075's partial fix suggests template handling functions were inadequately patched. The high confidence comes from: 1) The endpoint's exposure to anonymous users 2) Email service being explicitly mentioned 3) The pattern of template path manipulation being a common vector for combined XSS/path traversal vulnerabilities 4) Version 3.15.13's resolution indicating these components required fundamental fixes.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.gravitee.apim:gravitee-api-management | maven | < 3.15.13 | 3.15.13 |