-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.dom4j:dom4j | maven | <= 2.1.4 |
Miggo AIRoot Cause AnalysisThe POC demonstrates that SAXReader's feature configuration order impacts XXE vulnerability mitigation. While the advisory was withdrawn due to reproducibility issues, the technical analysis shows that: 1) The setFeature implementation's security depends on invocation order 2) Versions <=2.1.4 don't enforce consistent entity expansion restrictions when features are set in suboptimal sequences 3) The CWE-776 mapping confirms this is an entity expansion issue. The function's behavior matches the described vulnerability pattern even if the advisory status is disputed.
A Semantic Attack on Google Gemini - Read the Latest Research