-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from multiple instances of unsanitized user input being passed to innerHTML. The patch reveals systematic replacement of innerHTML with textContent and introduction of DOMPurify. Key indicators include: 1) Direct DOM manipulation methods (innerHTML) being replaced with safe alternatives in table cells, dropdowns and toast messages 2) Addition of DOMPurify library 3) Modification of data flow in search functionality to include sanitization. The identified functions directly handled user-controllable input (environment names, policy resources, search filters) without proper output encoding, enabling XSS payload execution when rendered.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.eclipse.ditto:ditto | maven | >= 3.0.0, < 3.4.5 | 3.4.5 |
| org.eclipse.ditto:ditto | maven | >= 3.5.0, < 3.5.6 | 3.5.6 |