-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from the absence of CSRF protection in the command execution flow. The patch adds a form token check (services.csrf.isTokenValid) before processing the command. The original code in RunShellCommand.xml executed shell commands through Runtime.getRuntime().exec(cmd) immediately after retrieving the 'command' parameter from the request, with no validation of request authenticity. This matches the CSRF attack pattern described where a crafted URL could trigger unauthorized command execution.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.contrib:xwiki-application-admintools | maven | >= 4.4, < 4.5.1 | 4.5.1 |
KEV Misses 88% of Exploited CVEs- Get the report