-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing server UUID validation when establishing client state. The pre-patch code in client.go created state services using NewStateService with a UUIDProvider that directly used server-supplied UUIDs. The session.go code similarly used server-reported UUIDs without validation. The patch adds ServerIdentityCheck validation before state creation, confirming these functions were vulnerable. The CWE-345 classification and commit message about validating server identity further confirm these state management functions were the vulnerability source.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/codenotary/immudb | go | < 1.4.1 | 1.4.1 |
Ongoing coverage of React2Shell