-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ezsystems/ezplatform-kernel | composer | >= 1.0.0, < 1.0.3 | 1.0.3 |
Miggo AIRoot Cause AnalysisThe vulnerability centers around unsafe deserialization in SiteAccessMatchListener. The advisory explicitly mentions this component as the injection point, and the CWE-94 (Code Injection) classification strongly indicates an unserialize() vulnerability. The function likely accepted attacker-controlled serialized data from request parameters (like cookies or headers) used for SiteAccess matching. The patched versions would have added validation/sanitization before deserialization.