-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-realtime-ui | maven | >= 13.9-rc-1, < 14.10.19 | 14.10.19 |
| org.xwiki.platform:xwiki-platform-realtime-ui | maven | >= 15.0-rc-1, < 15.5.4 | 15.5.4 |
| org.xwiki.platform:xwiki-platform-realtime-ui | maven | >= 15.6-rc-1, < 15.9 | 15.9 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the absence of a CSRF token check in the ConvertHTML API endpoint. The patch adds a mandatory CSRF token validation using $services.csrf.isTokenValid(), which was missing in the original code. The pre-patch code directly rendered content from CKEditor.ContentSheet without authentication safeguards, enabling CSRF-driven remote code execution. The commit diff and CWE-352 (CSRF) alignment confirm this as the root cause.
JavaJava