-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/fleetdm/fleet/v4 | go | >= 4.64.0, < 4.64.2 | 4.64.2 |
| github.com/fleetdm/fleet/v4 | go | >= 4.63.0, < 4.63.2 | 4.63.2 |
| github.com/fleetdm/fleet/v4 | go | >= 4.62.0, < 4.62.4 | 4.62.4 |
| github.com/fleetdm/fleet/v4 | go | >= 4.54.0, < 4.58.1 | 4.58.1 |
| github.com/fleetdm/fleet/v4 | go | < 4.53.2 | 4.53.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper SAML response validation. The commit diff shows critical changes to validateAssertionSignature - the original version used etreeutils.NSFindIterate which allowed processing multiple assertions without strict namespace enforcement. The patched version adds explicit checks for: 1) Exactly one Assertion element 2) Correct namespace 3) Signature validation. The CWE-74 (Injection) maps to processing untrusted XML elements, while CWE-285 (Authorization) relates to failing to properly authenticate assertions. The validateSignature() function's error handling (falling back to assertion validation without proper safeguards) created the entry point for exploitation.
A Semantic Attack on Google Gemini - Read the Latest Research