search

amaybaum-dev / easybuggy

Too buggy web application
Apache License 2.0
0 stars 3 forks source link

xalan-2.7.0.jar: 1 vulnerabilities (highest severity is: 7.3) unreachable #8

Open dev-mend-for-github-com[bot] opened 1 year ago

dev-mend-for-github-com[bot] commented 1 year ago
Vulnerable Library - xalan-2.7.0.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/xalan/xalan/2.7.0/xalan-2.7.0.jar,/target/easybuggy-1-SNAPSHOT/WEB-INF/lib/xalan-2.7.0.jar

Found in HEAD commit: 69b5f6630388e87c455fe776fcb9452a32d03bb6

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (xalan version) Remediation Possible** Reachability
CVE-2014-0107 High 7.3 xalan-2.7.0.jar Direct 2.7.2 ✅

Unreachable

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2014-0107 ### Vulnerable Library - xalan-2.7.0.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/xalan/xalan/2.7.0/xalan-2.7.0.jar,/target/easybuggy-1-SNAPSHOT/WEB-INF/lib/xalan-2.7.0.jar

Dependency Hierarchy: - :x: **xalan-2.7.0.jar** (Vulnerable Library)

Found in HEAD commit: 69b5f6630388e87c455fe776fcb9452a32d03bb6

Found in base branch: master

### Reachability Analysis

The vulnerable code is unreachable

### Vulnerability Details

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Publish Date: 2014-04-15

URL: CVE-2014-0107

### CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0107

Release Date: 2014-04-15

Fix Resolution: 2.7.2

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.