-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zendframework/zendframework | composer | >= 2.0.0, < 2.0.8 | 2.0.8 |
| zendframework/zendframework | composer | >= 2.1.0, < 2.1.4 | 2.1.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how Query route's match() method processed query parameters. Before patching, it: 1. Retrieved query parameters via $request->getQuery()->toArray() 2. Merged them with route defaults using array_merge() 3. Stored them in RouteMatch. This allowed query parameters to override previously matched parameters from parent routes (like controller/key) without respecting their constraints. The commit 0a7ec34 specifically removed this merging behavior, confirming this function was the vulnerable component. The security advisory explicitly mentions this method's parameter merging as the root cause.