-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| silverstripe/framework | composer | >= 4.0.0-rc1, < 4.0.5 | 4.0.5 |
| silverstripe/framework | composer | >= 4.1.0-rc1, < 4.1.3 | 4.1.3 |
| silverstripe/framework | composer | >= 4.2.0-rc1, < 4.2.2 | 4.2.2 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stemmed from two key issues: 1) An overly broad URL match in HTTPApplication's flush detection that allowed subpaths of dev/build to trigger rebuilds, and 2) Missing token validation enforcement for dev/build requests in the error control middleware. The combination allowed unauthenticated attackers to trigger resource-heavy dev/build operations via crafted URLs. The patch tightened the URL match to exact 'dev/build' and introduced a dedicated URLConfirmationToken check for this endpoint.
KEV Misses 88% of Exploited CVEs- Get the report