-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
C#C#Miggo AIRoot Cause AnalysisThe core vulnerability stems from UriExtensions.ToMaskedString's inability to process multiple comma-separated URLs. When passed a list like 'url1,url2', it created a malformed single Uri instead of splitting and masking each URL individually. The DiscoveryClient.FetchRegistryAsync method triggered this vulnerability by passing the raw EurekaServerServiceUrls string to ToMaskedString during error logging. The commit diff shows the fix involved modifying ToMaskedString to split URLs before masking, confirming these functions' roles in the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Steeltoe.Discovery.Eureka | nuget | <= 3.2.7 | 3.2.8 |
| Steeltoe.Discovery.EurekaBase | nuget | <= 2.5.5 | |
| Steeltoe.Discovery.ClientCore |
| nuget |
| < 3.0.0 |
| Steeltoe.Discovery.ClientAutofac | nuget | <= 2.5.5 |
KEV Misses 88% of Exploited CVEs- Get the report