-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe key vulnerability was in template rendering logic. The commit diff shows removal of the '|safe' filter from error message rendering in generic_field.html. In Django templates, '|safe' marks content as HTML-safe and disables auto-escaping. When combined with user-controllable error messages (like form validation errors), this would enable stored XSS. The JavaScript modification in twocols_nav.js appears to be a secondary fix for proper form handling but doesn't directly enable XSS. The core vulnerability stemmed from improper output encoding in the template layer.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| modoboa | pip | < 2.2.2 | 2.2.2 |
Ongoing coverage of React2Shell