-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from JSP files directly embedding user-controlled parameters (like request parameters and headers) into HTML output without proper sanitization. The commit diff shows vulnerable patterns where parameters were inserted using <%= ... %> without WebSecurityUtils.sanitizeString. Each identified file contains instances where untrusted input (ipAddr, task, returnTo, User-Agent header, userID) was reflected in the response without encoding, enabling XSS payload injection. The high confidence comes from the explicit addition of sanitization in the patch and the CWE-79 classification.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.opennms:opennms-webapp | maven | >= 31.0.8, < 32.0.2 | 32.0.2 |