-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-invitation-ui | maven | >= 2.5-m-1, < 14.4.8 | 14.4.8 |
| org.xwiki.platform:xwiki-platform-invitation-ui | maven | >= 14.5, < 14.10.6 | 14.10.6 |
| org.xwiki.platform:xwiki-platform-invitation-ui | maven | >= 15.0-rc-1, < 15.2-rc-1 | 15.2-rc-1 |
JavaJavaMiggo AIRoot Cause AnalysisThe core vulnerability stems from improper escaping in Velocity macros handling invitation subject lines. The patch adds 'wiki="false"' to disable wiki syntax parsing within these macros, which previously allowed attackers to inject {{groovy}} macros. Both InvitationCommon.xml and InvitationConfig.xml contained the vulnerable Velocity template definition that processed user-controlled input without proper context isolation, leading to code evaluation. The test cases added in the commit verify that macro syntax in subjectLine parameters is now properly escaped, confirming the attack vector.
Ongoing coverage of React2Shell