Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-0100

CVE-2023-0100: Improper Input Validation In Eclipse BIRT

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-0100
GHSA ID
GHSA-4grc-q4fj-45p8
EPSS Score
0.55811%
CWE
CWE-20
Published
3/15/2023
Updated
3/22/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.eclipse.birt:org.eclipse.birt.report.viewermaven>= 2.6.2, < 4.134.13

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from improper host validation when processing the __report parameter. The patch in PR #1165 modified how the server's hostname is determined (switching from Host header to server configuration). The ReportServiceServlet.processRequest is the logical entry point for report handling, where this validation would occur. The high confidence comes from the direct correlation between the vulnerability description, the fix's nature (hardening host validation), and the typical structure of BIRT's request handling flow.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

In **lips* *IRT, st*rtin* *rom v*rsion *.*.*, t** ****ult *on*i*ur*tion *llow** to r*tri*v* * r*port *rom t** s*m* *ost usin* *n **solut* *TTP p*t* *or t** r*port p*r*m*t*r (*.*. __r*port=*ttp://xyz.*om/r*port.rpt**si*n). I* t** *ost in*i**t** in t**

Reasoning

T** vuln*r**ility st*mm** *rom improp*r *ost v*li**tion w**n pro**ssin* t** __r*port p*r*m*t*r. T** p*t** in PR #**** mo*i*i** *ow t** s*rv*r's *ostn*m* is **t*rmin** (swit**in* *rom *ost *****r to s*rv*r *on*i*ur*tion). T** `R*portS*rvi**S*rvl*t.pro