-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing CSRF protections in the query execution flow. The commit diff shows the patched version added a 'form_token' parameter to SQLTools.getForm and added CSRF validation checks in Query.xml/QueryOnXWiki.xml. The original getForm method (without the token) allowed form submissions to execute arbitrary database queries without CSRF validation. This function is directly responsible for rendering the vulnerable form interface, making it the root enabler of the CSRF vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.contrib:xwiki-application-admintools | maven | < 4.5.1 | 4.5.1 |
Ongoing coverage of React2Shell