-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.streampipes:streampipes-parent | maven | < 0.95.0 | 0.95.0 |
| streampipes | pip | < 0.95.0 | 0.95.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper validation of custom endpoints during pipeline installation. The commit diff shows the removal of makeFinalPipeline in favor of makePipeline, which likely introduced validation checks. The makeFinalPipeline function in object-provider.service.ts was previously used to construct pipeline configurations without adequate endpoint validation, allowing SSRF. The submit function in pipeline-assembly.component.ts triggered this vulnerable process. The UI changes in adapter-deployment-settings.component.ts suggest endpoint input handling improvements, but the core vulnerability resided in the pipeline construction logic.
JavaJavaOngoing coverage of React2Shell