5l1D3R / Github-actions

0 stars 0 forks source link

CVE: 0000-0000 found in Apache Commons IO - Version: 2.4 [JAVA] #6

Open github-actions[bot] opened 1 year ago

github-actions[bot] commented 1 year ago

Veracode Software Composition Analysis

Attribute Details
Library Apache Commons IO
Description The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.
Language JAVA
Vulnerability Remote Code Execution (RCE) Via Java Object Deserialization
Vulnerability description commons-io is vulnerable to remote code execution (RCE) attacks. These attacks are possible because the library doesn't restrict the classes which can be accepted when deserializing a binary.
CVE null
CVSS score 5.1
Vulnerability present in version/s 1.0-2.4
Found library version/s 2.4
Vulnerability fixed in version 2.5
Library latest version 2.11.0
Fix

Links:

github-actions[bot] commented 1 year ago

Veracode issue link to PR: https://github.com/5l1D3R/Github-actions/pull/2