-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.commons:xwiki-commons-xml | maven | >= 14.6-rc-1, < 14.10.6 | 14.10.6 |
| org.xwiki.commons:xwiki-commons-xml | maven | >= 15.0-rc-1, < 15.2-rc-1 | 15.2-rc-1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from form-related tags being included in the allowed HTML tags list during sanitization. The commit diff shows these tags were explicitly removed from the htmlTags HashSet in the HTMLDefinitions constructor. The presence of these tags in the allowed list enabled XSS and RCE vectors via crafted form submissions. The test file modification adding checks for these tags confirms their improper allowance was the root cause.
Ongoing coverage of React2Shell