-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| neos/neos | composer | >= 2.3.0, < 3.0.20 | 3.0.20 |
| neos/neos | composer | >= 3.1.0, < 3.1.18 | 3.1.18 |
| neos/neos | composer | >= 3.2.0, < 3.2.14 | 3.2.14 |
| neos/neos | composer | >= 3.3.0, < 3.3.23 | 3.3.23 |
| neos/neos | composer | >= 4.0.0, < 4.0.17 | 4.0.17 |
| neos/neos | composer | >= 4.1.0, < 4.1.16 | 4.1.16 |
| neos/neos | composer | >= 4.2.0, < 4.2.12 | 4.2.12 |
| neos/neos | composer | >= 4.3.0, < 4.3.3 | 4.3.3 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from unauthenticated access to internal workspaces via URL manipulation. The NodeController.showAction is the primary entry point for frontend rendering and would handle workspace context resolution. The ContextFactory.create method is critical for workspace initialization. Together they form the chain that likely lacks proper authorization checks for internal workspaces. Confidence is high for NodeController as it's directly tied to URL handling, and medium for ContextFactory as the exact vulnerability trigger depends on implementation details.