-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability description clearly states that the newAction of the newController is vulnerable due to a user parameter. The provided commit 54851f8f60254bd8060bdf7bc16d56f4de7bd828 directly addresses this by removing the User $user = null parameter from the newAction method in Classes/Controller/NewController.php. The commit message "[SECURITY] Don't pass User to newAction" further confirms this. The patch shows the removal of the $user parameter and its usage within the function, which is direct evidence of the vulnerability and its fix.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| in2code/femanager | composer | >= 8.0.0, < 8.2.2 | 8.2.2 |
| in2code/femanager | composer | >= 7.0.0, < 7.4.2 | 7.4.2 |
| in2code/femanager | composer | >= 6.0.0, < 6.4.1 | 6.4.1 |
| in2code/femanager | composer | >= 5.5.0, < 5.5.5 | 5.5.5 |
Ongoing coverage of React2Shell