-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from the sendRedirect method's handling of redirect URLs. The commit diff shows the regex pattern for absolute URLs was updated from '[a-z0-9]+://.' to '[a-z0-9]+:/[/]?.', indicating the original regex missed cases with fewer than two slashes. The added check for '//' at the start of the URL further confirms this was an attack vector. The tests in XWikiServletResponseTest.java validate these fixes, demonstrating scenarios where malicious redirects (e.g., '//xwiki.org') are now blocked. The CWE-601 classification and advisory details align with these code changes, confirming the function's role in the open redirect vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-oldcore | maven | < 14.10.4 | 14.10.4 |
Ongoing coverage of React2Shell