-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.inlong:manager-pojo | maven | >= 1.4.0, < 1.7.0 | 1.7.0 |
| org.apache.inlong:manager-dao | maven | >= 1.4.0, < 1.7.0 | 1.7.0 |
| org.apache.inlong:manager-web | maven | >= 1.4.0, < 1.7.0 | 1.7.0 |
| org.apache.inlong:manager-service | maven | >= 1.4.0, < 1.7.0 | 1.7.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from sessions not being invalidated upon user deletion/password change. PR #7884 specifically modifies UserServiceImpl.java to add session invalidation during user deletion. The pre-patch version of the delete function lacked this critical security measure, making it the clear vulnerable entry point. While password change handling might also be involved, the provided patches focus on user deletion as the primary vector.
A Semantic Attack on Google Gemini - Read the Latest Research