-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zendframework/zendframework | composer | >= 2.2.0, < 2.2.5 | 2.2.5 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from the pre-2.2.5 implementation of getIpAddressFromProxy() which lacked a critical security check. The commit diff shows the addition of 'in_array($_SERVER['REMOTE_ADDR'], $this->trustedProxies)' to the method's condition, directly addressing the trust validation gap. The CWE-601 mapping and advisory descriptions confirm this function's flawed logic enabled open redirect-like IP spoofing when handling untrusted proxies.
Ongoing coverage of React2Shell