-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | < 9.2.3 | 9.2.3 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the endpoint /ccm/system/dialogs/logs/delete_all/submit which maps to a controller action. Release notes indicate the fix involved adding CSRF token validation and restricting to POST requests (commit 11764). The submit handler for log deletion would be the direct processing function for this endpoint. CSRF vulnerabilities typically occur when state-changing actions lack anti-CSRF protections, which aligns with the described attack vector of admin-triggered log deletion via forged requests.
Ongoing coverage of React2Shell