Closed dev-mend-for-github-com[bot] closed 1 year ago
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
Path to dependency file: /webgoat-integration-tests/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/5.2.2.RELEASE/spring-web-5.2.2.RELEASE.jar
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2022-22965
### Vulnerable Library - spring-beans-5.2.2.RELEASE.jarSpring Beans
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /webgoat-server/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-beans/5.2.2.RELEASE/spring-beans-5.2.2.RELEASE.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - spring-boot-starter-web-2.2.2.RELEASE.jar - spring-boot-starter-2.2.2.RELEASE.jar - spring-boot-2.2.2.RELEASE.jar - spring-context-5.2.2.RELEASE.jar - spring-aop-5.2.2.RELEASE.jar - :x: **spring-beans-5.2.2.RELEASE.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Reachability AnalysisThis vulnerability is potentially used ``` org.springframework.beans.CachedIntrospectionResults (Application) -> org.springframework.beans.BeanUtils (Extension) -> org.springframework.web.context.ContextLoader (Extension) -> org.springframework.core.env.PropertySource (Extension) ... -> org.springframework.core.env.ConfigurableEnvironment (Extension) -> org.springframework.context.ConfigurableApplicationContext (Extension) -> ❌ org.owasp.webwolf.WebWolf (Vulnerable Component) ```
### Vulnerability DetailsA Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. Mend Note: Converted from WS-2022-0107, on 2022-11-07.
Publish Date: 2022-04-01
URL: CVE-2022-22965
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
Release Date: 2022-04-01
Fix Resolution: org.springframework:spring-beans:5.2.20.RELEASE,5.3.18
CVE-2016-1000027
### Vulnerable Library - spring-web-5.2.2.RELEASE.jarSpring Web
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /webgoat-server/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/5.2.2.RELEASE/spring-web-5.2.2.RELEASE.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - spring-boot-starter-web-2.2.2.RELEASE.jar - spring-boot-starter-json-2.2.2.RELEASE.jar - :x: **spring-web-5.2.2.RELEASE.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Reachability AnalysisThe vulnerable code is not reachable.
### Vulnerability DetailsPivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
Publish Date: 2020-01-02
URL: CVE-2016-1000027
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2020-01-02
Fix Resolution: org.springframework:spring-web:5.3.0
CVE-2020-10683
### Vulnerable Library - dom4j-2.1.1.jarflexible XML framework for Java
Library home page: http://dom4j.github.io/
Path to dependency file: /webgoat-server/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/dom4j/dom4j/2.1.1/dom4j-2.1.1.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - spring-boot-starter-data-jpa-2.2.2.RELEASE.jar - hibernate-core-5.4.9.Final.jar - :x: **dom4j-2.1.1.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Reachability AnalysisThe vulnerable code is not reachable.
### Vulnerability Detailsdom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
Publish Date: 2020-05-01
URL: CVE-2020-10683
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2020-05-01
Fix Resolution: org.dom4j:dom4j:2.1.3,org.dom4j:dom4j:2.0.3
CVE-2022-1471
### Vulnerable Library - snakeyaml-1.25.jarYAML 1.1 parser and emitter for Java
Library home page: http://www.snakeyaml.org
Path to dependency file: /webgoat-container/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.25/snakeyaml-1.25.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - spring-boot-starter-web-2.2.2.RELEASE.jar - spring-boot-starter-2.2.2.RELEASE.jar - :x: **snakeyaml-1.25.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Reachability AnalysisThe vulnerable code is not reachable.
### Vulnerability DetailsSnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Publish Date: 2022-12-01
URL: CVE-2022-1471
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374
Release Date: 2022-12-01
Fix Resolution: org.yaml:snakeyaml:2.0
CVE-2021-22112
### Vulnerable Library - spring-security-web-5.2.1.RELEASE.jarspring-security-web
Library home page: http://spring.io/spring-security
Path to dependency file: /webgoat-integration-tests/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-web/5.2.1.RELEASE/spring-security-web-5.2.1.RELEASE.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - spring-boot-starter-security-2.2.2.RELEASE.jar - :x: **spring-security-web-5.2.1.RELEASE.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Reachability AnalysisThis vulnerability is potentially used ``` org.springframework.security.web.context.HttpSessionSecurityContextRepository$SaveToSessionResponseWrapper (Application) -> ❌ org.owasp.webgoat.idor.IDORViewOtherProfile (Vulnerable Component) ```
### Vulnerability DetailsSpring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
Publish Date: 2021-02-23
URL: CVE-2021-22112
### CVSS 3 Score Details (8.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://tanzu.vmware.com/security/cve-2021-22112
Release Date: 2021-02-23
Fix Resolution: org.springframework.security:spring-security-web:5.2.9,5.3.8,5.4.4
WS-2019-0490
### Vulnerable Library - jcommander-1.35.jarA Java framework to parse command line options with annotations.
Library home page: http://beust.com/
Path to dependency file: /webgoat-server/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/beust/jcommander/1.35/jcommander-1.35.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - asciidoctorj-1.5.8.1.jar - :x: **jcommander-1.35.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Vulnerability DetailsInclusion of Functionality from Untrusted Control Sphere vulnerability found in jcommander before 1.75. jcommander resolving dependencies over HTTP instead of HTTPS.
Publish Date: 2019-02-19
URL: WS-2019-0490
### CVSS 3 Score Details (8.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2019-02-19
Fix Resolution: com.beust:jcommander:1.75
CVE-2021-22118
### Vulnerable Library - spring-web-5.2.2.RELEASE.jarSpring Web
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /webgoat-server/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/5.2.2.RELEASE/spring-web-5.2.2.RELEASE.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - spring-boot-starter-web-2.2.2.RELEASE.jar - spring-boot-starter-json-2.2.2.RELEASE.jar - :x: **spring-web-5.2.2.RELEASE.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Reachability AnalysisThe vulnerable code is not reachable.
### Vulnerability DetailsIn Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
Publish Date: 2021-05-27
URL: CVE-2021-22118
### CVSS 3 Score Details (7.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://tanzu.vmware.com/security/cve-2021-22118
Release Date: 2021-05-27
Fix Resolution: org.springframework:spring-web:5.2.15,5.3.7
CVE-2017-18640
### Vulnerable Library - snakeyaml-1.25.jarYAML 1.1 parser and emitter for Java
Library home page: http://www.snakeyaml.org
Path to dependency file: /webgoat-container/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.25/snakeyaml-1.25.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - spring-boot-starter-web-2.2.2.RELEASE.jar - spring-boot-starter-2.2.2.RELEASE.jar - :x: **snakeyaml-1.25.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Reachability AnalysisThe vulnerable code is not reachable.
### Vulnerability DetailsThe Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
Publish Date: 2019-12-12
URL: CVE-2017-18640
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18640
Release Date: 2019-12-12
Fix Resolution: org.yaml:snakeyaml:1.26
CVE-2022-25857
### Vulnerable Library - snakeyaml-1.25.jarYAML 1.1 parser and emitter for Java
Library home page: http://www.snakeyaml.org
Path to dependency file: /webgoat-container/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.25/snakeyaml-1.25.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - spring-boot-starter-web-2.2.2.RELEASE.jar - spring-boot-starter-2.2.2.RELEASE.jar - :x: **snakeyaml-1.25.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Reachability AnalysisThe vulnerable code is not reachable.
### Vulnerability DetailsThe package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
Publish Date: 2022-08-30
URL: CVE-2022-25857
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: test
Release Date: 2022-08-30
Fix Resolution: test
CVE-2020-25649
### Vulnerable Library - jackson-databind-2.10.1.jarGeneral data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /webgoat-integration-tests/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - spring-boot-starter-web-2.2.2.RELEASE.jar - spring-boot-starter-json-2.2.2.RELEASE.jar - :x: **jackson-databind-2.10.1.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Reachability AnalysisThe vulnerable code is not reachable.
### Vulnerability DetailsA flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
Publish Date: 2020-12-03
URL: CVE-2020-25649
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2020-12-03
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.6.7.4,2.9.10.7,2.10.5.1,2.11.0.rc1
CVE-2020-5398
### Vulnerable Library - spring-web-5.2.2.RELEASE.jarSpring Web
Library home page: https://github.com/spring-projects/spring-framework
Path to dependency file: /webgoat-server/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/5.2.2.RELEASE/spring-web-5.2.2.RELEASE.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - spring-boot-starter-web-2.2.2.RELEASE.jar - spring-boot-starter-json-2.2.2.RELEASE.jar - :x: **spring-web-5.2.2.RELEASE.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Reachability AnalysisThis vulnerability is potentially used ``` org.springframework.http.ContentDisposition (Application) -> org.springframework.web.multipart.support.StandardMultipartHttpServletRequest (Extension) -> ❌ org.owasp.webgoat.password_reset.ResetLinkAssignmentForgotPassword (Vulnerable Component) ```
### Vulnerability DetailsIn Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
Publish Date: 2020-01-17
URL: CVE-2020-5398
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://pivotal.io/security/cve-2020-5398
Release Date: 2020-01-17
Fix Resolution: org.springframework:spring-web:5.0.16.RELEASE,org.springframework:spring-web:5.1.13.RELEASE,org.springframework:spring-web:5.2.3.RELEASE
CVE-2021-46877
### Vulnerable Library - jackson-databind-2.10.1.jarGeneral data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /webgoat-integration-tests/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - spring-boot-starter-web-2.2.2.RELEASE.jar - spring-boot-starter-json-2.2.2.RELEASE.jar - :x: **jackson-databind-2.10.1.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Reachability AnalysisThis vulnerability is potentially used ``` com.fasterxml.jackson.databind.node.NodeSerialization (Application) -> com.fasterxml.jackson.databind.node.BaseJsonNode (Extension) -> com.fasterxml.jackson.databind.node.ArrayNode (Extension) -> com.fasterxml.jackson.databind.json.JsonMapper (Extension) -> ❌ org.owasp.webgoat.xss.stored.StoredXssComments (Vulnerable Component) ```
### Vulnerability Detailsjackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.
Publish Date: 2023-03-18
URL: CVE-2021-46877
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2021-46877
Release Date: 2023-03-18
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.12.6,2.13.1
CVE-2022-42004
### Vulnerable Library - jackson-databind-2.10.1.jarGeneral data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /webgoat-integration-tests/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - spring-boot-starter-web-2.2.2.RELEASE.jar - spring-boot-starter-json-2.2.2.RELEASE.jar - :x: **jackson-databind-2.10.1.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Vulnerability DetailsIn FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
Publish Date: 2022-10-02
URL: CVE-2022-42004
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-10-02
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.13.4
CVE-2022-42003
### Vulnerable Library - jackson-databind-2.10.1.jarGeneral data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /webgoat-integration-tests/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - spring-boot-starter-web-2.2.2.RELEASE.jar - spring-boot-starter-json-2.2.2.RELEASE.jar - :x: **jackson-databind-2.10.1.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Reachability AnalysisThis vulnerability is potentially used ``` com.fasterxml.jackson.databind.deser.std.StdDeserializer (Application) -> com.fasterxml.jackson.databind.deser.BeanDeserializerBase (Extension) -> com.fasterxml.jackson.databind.deser.std.ThrowableDeserializer (Extension) -> com.fasterxml.jackson.databind.deser.BeanDeserializerFactory (Extension) -> com.fasterxml.jackson.databind.ObjectMapper (Extension) -> ❌ org.owasp.webwolf.requests.Requests (Vulnerable Component) ```
### Vulnerability DetailsIn FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Additional fix version in 2.13.4.1 and 2.12.17.1
Publish Date: 2022-10-02
URL: CVE-2022-42003
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-10-02
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.12.7.1,2.13.4.1
CVE-2020-36518
### Vulnerable Library - jackson-databind-2.10.1.jarGeneral data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /webgoat-integration-tests/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.10.1/jackson-databind-2.10.1.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - spring-boot-starter-web-2.2.2.RELEASE.jar - spring-boot-starter-json-2.2.2.RELEASE.jar - :x: **jackson-databind-2.10.1.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Reachability AnalysisThis vulnerability is potentially used ``` com.fasterxml.jackson.databind.deser.std.UntypedObjectDeserializer$Vanilla (Application) -> com.fasterxml.jackson.databind.deser.std.UntypedObjectDeserializer (Extension) -> com.fasterxml.jackson.databind.deser.BasicDeserializerFactory (Extension) -> com.fasterxml.jackson.databind.deser.BeanDeserializerFactory (Extension) -> com.fasterxml.jackson.databind.ObjectMapper (Extension) -> ❌ org.owasp.webwolf.requests.Requests (Vulnerable Component) ```
### Vulnerability Detailsjackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. Mend Note: After conducting further research, Mend has determined that all versions of com.fasterxml.jackson.core:jackson-databind up to version 2.13.2 are vulnerable to CVE-2020-36518.
Publish Date: 2022-03-11
URL: CVE-2020-36518
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-03-11
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.12.6.1,2.13.2.1
CVE-2020-25638
### Vulnerable Library - hibernate-core-5.4.9.Final.jarHibernate's core ORM functionality
Library home page: http://hibernate.org/orm
Path to dependency file: /webgoat-integration-tests/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/hibernate/hibernate-core/5.4.9.Final/hibernate-core-5.4.9.Final.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - spring-boot-starter-data-jpa-2.2.2.RELEASE.jar - :x: **hibernate-core-5.4.9.Final.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Reachability AnalysisThis vulnerability is potentially used ``` org.hibernate.hql.internal.ast.tree.DotNode (Application) -> antlr.ASTFactory (Extension) -> org.hibernate.hql.internal.ast.tree.FromClause (Extension) -> org.postgresql.ssl.MakeSSL (Extension) ... -> org.postgresql.core.ConnectionFactory (Extension) -> org.postgresql.jdbc.PgConnection (Extension) -> ❌ org.owasp.webgoat.sql_injection.advanced.SqlInjectionChallenge (Vulnerable Component) ```
### Vulnerability DetailsA flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
Publish Date: 2020-12-02
URL: CVE-2020-25638
### CVSS 3 Score Details (7.4)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://in.relation.to/2020/11/19/hibernate-orm-5424-final-release/
Release Date: 2020-12-02
Fix Resolution: org.hibernate:hibernate-core:5.3.20.Final,5.4.24.Final
WS-2017-3767
### Vulnerable Library - spring-security-web-5.2.1.RELEASE.jarspring-security-web
Library home page: http://spring.io/spring-security
Path to dependency file: /webgoat-integration-tests/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-web/5.2.1.RELEASE/spring-security-web-5.2.1.RELEASE.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - spring-boot-starter-security-2.2.2.RELEASE.jar - :x: **spring-security-web-5.2.1.RELEASE.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Reachability AnalysisThis vulnerability is potentially used ``` org.springframework.security.web.authentication.switchuser.SwitchUserFilter (Application) -> org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration (Extension) -> ❌ org.owasp.webgoat.WebSecurityConfig (Vulnerable Component) ```
### Vulnerability DetailsCross-Site Request Forgery (CSRF) vulnerability was found in spring-security before 4.2.15, 5.0.15, 5.1.9, 5.2.3, and 5.3.1. SwitchUserFilter responds to all HTTP methods, making it vulnerable to CSRF attacks.
Publish Date: 2017-01-03
URL: WS-2017-3767
### CVSS 3 Score Details (6.6)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2017-01-03
Fix Resolution: org.springframework.security:spring-security-web:4.2.15,5.0.15,5.1.9,5.2.3,5.3.1
CVE-2019-14900
### Vulnerable Library - hibernate-core-5.4.9.Final.jarHibernate's core ORM functionality
Library home page: http://hibernate.org/orm
Path to dependency file: /webgoat-integration-tests/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/hibernate/hibernate-core/5.4.9.Final/hibernate-core-5.4.9.Final.jar
Dependency Hierarchy: - webgoat-server-v8.1.0.jar (Root Library) - webgoat-container-v8.1.0.jar - spring-boot-starter-data-jpa-2.2.2.RELEASE.jar - :x: **hibernate-core-5.4.9.Final.jar** (Vulnerable Library)
Found in HEAD commit: f0c1d123bb3375482e903c0febdd18513fb47ec8
Found in base branch: master
### Reachability AnalysisThis vulnerability is potentially used ``` org.hibernate.query.criteria.internal.expression.LiteralExpression (Application) -> org.hibernate.query.criteria.internal.CriteriaBuilderImpl (Extension) -> org.hibernate.internal.SessionFactoryImpl (Extension) -> org.hibernate.type.spi.TypeConfiguration (Extension) ... -> org.hibernate.dialect.AbstractHANADialect (Extension) -> org.hibernate.dialect.AbstractHANADialect$MaterializedNClob (Extension) -> ❌ org.owasp.webgoat.sql_injection.advanced.SqlInjectionChallenge (Vulnerable Component) ```
### Vulnerability DetailsA flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
Publish Date: 2020-07-06
URL: CVE-2019-14900
### CVSS 3 Score Details (6.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14900
Release Date: 2020-07-06
Fix Resolution: org.hibernate:hibernate-core:5.4.18.Final