-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-invitation-ui | maven | >= 2.5-m-1, < 13.10.11 | 13.10.11 |
| org.xwiki.platform:xwiki-platform-invitation-ui | maven | >= 14.0-rc-1, < 14.4.8 | 14.4.8 |
| org.xwiki.platform:xwiki-platform-invitation-ui | maven | >= 14.5, < 14.10.1 | 14.10.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper output escaping in the InvitationCommon.xml Velocity template. The patch adds $escapetool.xml() wrappers around multiple instances of $services.localization.render() and other dynamic outputs. The original code directly rendered these values without sanitization, allowing malicious payloads to be interpreted as code. The CWE-74 classification and reproduction steps confirm this was an injection vulnerability via unescaped output in the template. The added test cases validate proper escaping of script tags and macro syntax, confirming the vulnerable pattern.