-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| redaxo/source | composer | < 5.20.1 | 5.20.1 |
Miggo AIRoot Cause AnalysisThe analysis of the security advisory and the associated commit 58929062312cf03e344ab04067a365e6b6ee66aa reveals a primary reflected XSS vulnerability and two other potential XSS vulnerabilities that were fixed in the same patch. The main vulnerability, as described in the advisory, is located in redaxo/src/addons/mediapool/pages/media.list.php. This script directly includes the args[types] request parameter in its output without proper escaping. The patch confirms this by adding rex_escape() to the variable. Since this code is in the global scope of the PHP script, it's not contained within a specific function, so the vulnerable component is the script itself. During exploitation, a profiler would show execution within this file. Additionally, the patch addresses similar escaping issues in redaxo/src/addons/mediapool/lib/service_media.php. The functions rex_media_service::addMedia and rex_media_service::updateMedia were found to construct error messages with unescaped user-controllable data (file extensions and types). Although not the primary reported vulnerability, these could also lead to XSS if the error messages are displayed to the user. The patch proactively adds rex_escape() in these locations as well.
media.list.phpredaxo/src/addons/mediapool/pages/media.list.php
rex_media_service::addMediaredaxo/src/addons/mediapool/lib/service_media.php
rex_media_service::updateMediaredaxo/src/addons/mediapool/lib/service_media.php
Ongoing coverage of React2Shell