-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ome:pom-bio-formats | maven | <= 8.3.0 |
Miggo AIRoot Cause AnalysisThe analysis is based on the detailed vulnerability disclosure found on seclists.org. The disclosure includes a proof-of-concept and a stack trace that pinpoints the exact location of the vulnerability. The stack trace at LMSXmlDocument.initFromFilepath(LMSXmlDocument.java:125) directly implicates the initFromFilepath method in the LMSXmlDocument.java file as the source of the XXE vulnerability. The advisory explains that the DocumentBuilderFactory is not securely configured to prevent external entity expansion, which is the root cause of the vulnerability. Although no patch is available, the evidence from the advisory is sufficient to identify the vulnerable function with high confidence.
loci.formats.in.LMSXmlDocument.initFromFilepathcomponents/formats-bsd/src/loci/formats/in/LMSXmlDocument.java