-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.opencastproject:opencast-common | maven | < 12.5 | 12.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the auth.html's JavaScript code that handled redirect parameters. The pre-patch code (shown in the diff) lacked hostname validation when processing the 'redirect' parameter, using it directly in window.location.href. The patch added critical validation by comparing window.location.hostname with redirect URL's hostname. The absence of this validation in vulnerable versions allowed arbitrary redirects, matching the CWE-601 description of open redirect vulnerabilities.
Ongoing coverage of React2Shell