-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-help-ui | maven | >= 8.1-milestone-1, < 14.10.5 | 14.10.5 |
| org.xwiki.platform:xwiki-platform-help-ui | maven | >= 15.0-rc-1, < 15.1-rc-1 | 15.1-rc-1 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from how the TipsPanel processed UI extension parameters. The unpatched code in WebHome.xml retrieved the 'tip' content via $uixs.get($index).getParameters().get('tip') and rendered it without security restrictions. The patch introduced a restricted execution context ({{context restricted="true" ...}}), indicating the original lack of restrictions was the flaw. This function's failure to enforce safe execution context made it vulnerable to privilege escalation via crafted UI extensions.