-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe core vulnerability stems from two key points: 1) The AbstractQueryBlackListHandler's isPass method lacked proper input validation (specifically for hyphens in table/field names) prior to the patch, as shown by the added regex pattern in the fix. 2) The queryTableDictItemsByCode controller method serves as the entry point that accepts external parameters and interacts with the vulnerable validation logic. The patch adds critical validation checks in AbstractQueryBlackListHandler, confirming these were the missing security controls.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jeecgframework.boot:jeecg-boot-parent | maven | < 3.5.1 | 3.5.1 |