-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-security-requiredrights-default | maven | >= 15.9-rc-1, < 15.10.8 | 15.10.8 |
| org.xwiki.platform:xwiki-platform-security-requiredrights-default | maven | >= 16.0.0-rc-1, < 16.2.0 | 16.2.0 |
Miggo AIRoot Cause AnalysisThe vulnerability description clearly states that the issue lies in the analysis of TextArea properties with default content types. The provided commit directly modifies the analyzeTextAreaProperty method within DefaultObjectRequiredRightAnalyzer.java. The changes in the patch ensure that even if a TextArea property's content type is initially null, it's defaulted to WIKI_TEXT, and its content is subsequently analyzed. The old logic if (contentType != null && StringUtils.isNotBlank(value)) would have prevented analysis if contentType was null. The new logic, by setting a default and changing the condition to if (StringUtils.isNotBlank(value)), ensures analysis occurs. This directly addresses the described vulnerability, making analyzeTextAreaProperty the function that contained the flaw.