-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.graylog2:graylog2-server | maven | < 6.2.0 | 6.2.0 |
Miggo AIRoot Cause AnalysisThe vulnerability description points to two combined issues: file upload and API browser rendering. The provided commit directly addresses the API browser rendering part by adding escaping to response headers. The swagger-ui.js file is part of the API browser, and the change explicitly adds Handlebars.Utils.escapeExpression to sanitize the output. This strongly suggests that the lack of escaping in this specific part of the API browser was one of the vulnerabilities. The other part of the vulnerability (Files Plugin) is addressed by removing the generic API, which is a broader change not pinpointed to a single function in this commit but is mentioned in the advisory.
Ongoing coverage of React2Shell