search

amaybaum-local / EasyBuggy3

Apache License 2.0
0 stars 1 forks source link

esapi-2.1.0.1.jar: 13 vulnerabilities (highest severity is: 9.8) reachable - autoclosed #7

Closed mend-local-app[bot] closed 1 year ago

mend-local-app[bot] commented 1 year ago
Vulnerable Library - esapi-2.1.0.1.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/org/owasp/antisamy/antisamy/1.5.3/antisamy-1.5.3.jar

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (esapi version) Remediation Possible** Reachability
CVE-2016-1000031 High 9.8 commons-fileupload-1.3.1.jar Transitive N/A* ❌

CVE-2016-2510 High 8.1 bsh-core-2.0b4.jar Transitive N/A* ❌

CVE-2014-0107 High 7.5 xalan-2.7.0.jar Transitive N/A* ❌

CVE-2016-3092 High 7.5 commons-fileupload-1.3.1.jar Transitive N/A* ❌

CVE-2014-0114 High 7.5 commons-beanutils-core-1.8.3.jar Transitive N/A* ❌

CVE-2012-0881 High 7.5 xercesImpl-2.8.0.jar Transitive N/A* ❌

WS-2014-0034 High 7.5 commons-fileupload-1.3.1.jar Transitive N/A* ❌

CVE-2019-10086 High 7.3 commons-beanutils-core-1.8.3.jar Transitive N/A* ❌

CVE-2013-4002 High 7.1 xercesImpl-2.8.0.jar Transitive N/A* ❌

CVE-2016-10006 Medium 6.1 antisamy-1.5.3.jar Transitive N/A* ❌

CVE-2017-14735 Medium 6.1 antisamy-1.5.3.jar Transitive N/A* ❌

CVE-2012-5783 Medium 5.8 commons-httpclient-3.1.jar Transitive N/A* ❌

CVE-2009-2625 Medium 5.3 xercesImpl-2.8.0.jar Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2016-1000031 ### Vulnerable Library - commons-fileupload-1.3.1.jar

The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/commons-fileupload/commons-fileupload/1.3.1/commons-fileupload-1.3.1.jar

Dependency Hierarchy: - esapi-2.1.0.1.jar (Root Library) - :x: **commons-fileupload-1.3.1.jar** (Vulnerable Library)

Found in base branch: master

### Reachability Analysis

This vulnerability is potentially used ``` org.t246osslab.easybuggy.core.servlets.AbstractServlet (Application) -> org.owasp.esapi.ESAPI (Extension) -> org.owasp.esapi.reference.DefaultHTTPUtilities (Extension) -> ❌ org.apache.commons.fileupload.FileItem (Vulnerable Component) ```

### Vulnerability Details

Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution

Publish Date: 2016-10-25

URL: CVE-2016-1000031

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031

Release Date: 2016-10-25

Fix Resolution: 1.3.3

CVE-2016-2510 ### Vulnerable Library - bsh-core-2.0b4.jar

BeanShell core

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/org/beanshell/bsh-core/2.0b4/bsh-core-2.0b4.jar

Dependency Hierarchy: - esapi-2.1.0.1.jar (Root Library) - :x: **bsh-core-2.0b4.jar** (Vulnerable Library)

Found in base branch: master

### Reachability Analysis

The vulnerable code is not reachable.

### Vulnerability Details

BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.

Publish Date: 2016-04-07

URL: CVE-2016-2510

### CVSS 3 Score Details (8.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-2510

Release Date: 2016-04-07

Fix Resolution: 2.0b6

CVE-2014-0107 ### Vulnerable Library - xalan-2.7.0.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/xalan/xalan/2.7.0/xalan-2.7.0.jar

Dependency Hierarchy: - esapi-2.1.0.1.jar (Root Library) - xom-1.2.5.jar - :x: **xalan-2.7.0.jar** (Vulnerable Library)

Found in base branch: master

### Reachability Analysis

The vulnerable code is not reachable.

### Vulnerability Details

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Publish Date: 2014-04-15

URL: CVE-2014-0107

### CVSS 2 Score Details (7.5)

Base Score Metrics not available

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0107

Release Date: 2014-04-15

Fix Resolution: 2.7.2

CVE-2016-3092 ### Vulnerable Library - commons-fileupload-1.3.1.jar

The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/commons-fileupload/commons-fileupload/1.3.1/commons-fileupload-1.3.1.jar

Dependency Hierarchy: - esapi-2.1.0.1.jar (Root Library) - :x: **commons-fileupload-1.3.1.jar** (Vulnerable Library)

Found in base branch: master

### Reachability Analysis

This vulnerability is potentially used ``` org.t246osslab.easybuggy.core.servlets.AbstractServlet (Application) -> org.owasp.esapi.ESAPI (Extension) -> org.owasp.esapi.waf.internal.InterceptingHTTPServletRequest (Extension) -> org.apache.commons.fileupload.servlet.ServletFileUpload (Extension) -> org.apache.commons.fileupload.FileUploadBase (Extension) -> org.apache.commons.fileupload.FileUploadBase$FileItemIteratorImpl (Extension) -> ❌ org.apache.commons.fileupload.MultipartStream (Vulnerable Component) ```

### Vulnerability Details

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

Publish Date: 2016-07-04

URL: CVE-2016-3092

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3092

Release Date: 2016-07-04

Fix Resolution: org.apache.tomcat.embed:tomcat-embed-core:9.0.0.M8,8.5.3,8.0.36,7.0.70,org.apache.tomcat:tomcat-coyote:9.0.0.M8,8.5.3,8.0.36,7.0.70,commons-fileupload:commons-fileupload:1.3.2

CVE-2014-0114 ### Vulnerable Library - commons-beanutils-core-1.8.3.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/commons-beanutils/commons-beanutils-core/1.8.3/commons-beanutils-core-1.8.3.jar

Dependency Hierarchy: - esapi-2.1.0.1.jar (Root Library) - :x: **commons-beanutils-core-1.8.3.jar** (Vulnerable Library)

Found in base branch: master

### Reachability Analysis

The vulnerable code is not reachable.

### Vulnerability Details

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

Publish Date: 2014-04-30

URL: CVE-2014-0114

### CVSS 2 Score Details (7.5)

Base Score Metrics not available

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114

Release Date: 2014-04-30

Fix Resolution: commons-beanutils:commons-beanutils:1.9.4;org.apache.struts:struts2-core:2.0.5

CVE-2012-0881 ### Vulnerable Library - xercesImpl-2.8.0.jar

Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI), a complete framework for building parser components and configurations that is extremely modular and easy to program.

Library home page: http://xerces.apache.org/xerces2-j

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/xerces/xercesImpl/2.8.0/xercesImpl-2.8.0.jar

Dependency Hierarchy: - esapi-2.1.0.1.jar (Root Library) - xom-1.2.5.jar - :x: **xercesImpl-2.8.0.jar** (Vulnerable Library)

Found in base branch: master

### Reachability Analysis

This vulnerability is potentially used ``` org.t246osslab.easybuggy.core.servlets.AbstractServlet (Application) -> org.owasp.esapi.ESAPI (Extension) -> org.owasp.esapi.reference.DefaultValidator (Extension) -> org.apache.xerces.dom.DocumentImpl (Extension) ... -> org.apache.xerces.dom.CoreDOMImplementationImpl (Extension) -> org.apache.xerces.impl.dtd.XMLDTDLoader (Extension) -> ❌ org.apache.xerces.util.SymbolTable (Vulnerable Component) ```

### Vulnerability Details

Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.

Publish Date: 2017-10-30

URL: CVE-2012-0881

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0881

Release Date: 2017-10-30

Fix Resolution: 2.12.0

WS-2014-0034 ### Vulnerable Library - commons-fileupload-1.3.1.jar

The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/commons-fileupload/commons-fileupload/1.3.1/commons-fileupload-1.3.1.jar

Dependency Hierarchy: - esapi-2.1.0.1.jar (Root Library) - :x: **commons-fileupload-1.3.1.jar** (Vulnerable Library)

Found in base branch: master

### Reachability Analysis

This vulnerability is potentially used ``` org.t246osslab.easybuggy.core.servlets.AbstractServlet (Application) -> org.owasp.esapi.ESAPI (Extension) -> org.owasp.esapi.waf.internal.InterceptingHTTPServletRequest (Extension) -> org.apache.commons.fileupload.servlet.ServletFileUpload (Extension) -> ❌ org.apache.commons.fileupload.FileUploadBase (Vulnerable Component) ```

### Vulnerability Details

The class FileUploadBase in Apache Commons Fileupload before 1.4 has potential resource leak - InputStream not closed on exception.

Publish Date: 2014-02-17

URL: WS-2014-0034

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2019-09-26

Fix Resolution: 1.4

CVE-2019-10086 ### Vulnerable Library - commons-beanutils-core-1.8.3.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/commons-beanutils/commons-beanutils-core/1.8.3/commons-beanutils-core-1.8.3.jar

Dependency Hierarchy: - esapi-2.1.0.1.jar (Root Library) - :x: **commons-beanutils-core-1.8.3.jar** (Vulnerable Library)

Found in base branch: master

### Reachability Analysis

The vulnerable code is not reachable.

### Vulnerability Details

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

Publish Date: 2019-08-20

URL: CVE-2019-10086

### CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4@apache.org%3e

Release Date: 2019-08-20

Fix Resolution: 1.9.4

CVE-2013-4002 ### Vulnerable Library - xercesImpl-2.8.0.jar

Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI), a complete framework for building parser components and configurations that is extremely modular and easy to program.

Library home page: http://xerces.apache.org/xerces2-j

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/xerces/xercesImpl/2.8.0/xercesImpl-2.8.0.jar

Dependency Hierarchy: - esapi-2.1.0.1.jar (Root Library) - xom-1.2.5.jar - :x: **xercesImpl-2.8.0.jar** (Vulnerable Library)

Found in base branch: master

### Reachability Analysis

This vulnerability is potentially used ``` org.t246osslab.easybuggy.core.servlets.AbstractServlet (Application) -> org.owasp.esapi.ESAPI (Extension) -> org.owasp.esapi.reference.DefaultValidator (Extension) -> org.apache.xerces.dom.DocumentImpl (Extension) ... -> org.apache.xerces.dom.CoreDOMImplementationImpl (Extension) -> org.apache.xerces.impl.dtd.XMLDTDLoader (Extension) -> ❌ org.apache.xerces.impl.XMLScanner (Vulnerable Component) ```

### Vulnerability Details

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.

Publish Date: 2013-07-23

URL: CVE-2013-4002

### CVSS 2 Score Details (7.1)

Base Score Metrics not available

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4002

Release Date: 2013-07-23

Fix Resolution: xerces:xercesImpl:Xerces-J_2_12_0

CVE-2016-10006 ### Vulnerable Library - antisamy-1.5.3.jar

The OWASP AntiSamy project is a collection of APIs for safely allowing users to supply their own HTML and CSS without exposing the site to XSS vulnerabilities.

Library home page: http://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/org/owasp/antisamy/antisamy/1.5.3/antisamy-1.5.3.jar

Dependency Hierarchy: - esapi-2.1.0.1.jar (Root Library) - :x: **antisamy-1.5.3.jar** (Vulnerable Library)

Found in base branch: master

### Reachability Analysis

This vulnerability is potentially used ``` org.t246osslab.easybuggy.core.servlets.AbstractServlet (Application) -> org.owasp.esapi.ESAPI (Extension) -> org.owasp.esapi.reference.DefaultValidator (Extension) -> org.owasp.esapi.reference.validation.HTMLValidationRule (Extension) -> org.owasp.validator.html.AntiSamy (Extension) -> org.owasp.validator.html.scan.AntiSamySAXScanner (Extension) -> ❌ org.owasp.validator.html.scan.MagicSAXFilter (Vulnerable Component) ```

### Vulnerability Details

In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS.

Publish Date: 2016-12-24

URL: CVE-2016-10006

### CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10006

Release Date: 2016-12-24

Fix Resolution: 1.5.5

CVE-2017-14735 ### Vulnerable Library - antisamy-1.5.3.jar

The OWASP AntiSamy project is a collection of APIs for safely allowing users to supply their own HTML and CSS without exposing the site to XSS vulnerabilities.

Library home page: http://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/org/owasp/antisamy/antisamy/1.5.3/antisamy-1.5.3.jar

Dependency Hierarchy: - esapi-2.1.0.1.jar (Root Library) - :x: **antisamy-1.5.3.jar** (Vulnerable Library)

Found in base branch: master

### Reachability Analysis

This vulnerability is potentially used ``` org.t246osslab.easybuggy.core.servlets.AbstractServlet (Application) -> org.owasp.esapi.ESAPI (Extension) -> org.owasp.esapi.reference.DefaultValidator (Extension) -> org.owasp.esapi.reference.validation.HTMLValidationRule (Extension) -> ❌ org.owasp.validator.html.Policy (Vulnerable Component) ```

### Vulnerability Details

OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.

Publish Date: 2017-09-25

URL: CVE-2017-14735

### CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14735

Release Date: 2017-09-25

Fix Resolution: 1.5.7

CVE-2012-5783 ### Vulnerable Library - commons-httpclient-3.1.jar

The HttpClient component supports the client-side of RFC 1945 (HTTP/1.0) and RFC 2616 (HTTP/1.1) , several related specifications (RFC 2109 (Cookies) , RFC 2617 (HTTP Authentication) , etc.), and provides a framework by which new request types (methods) or HTTP extensions can be created easily.

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/commons-httpclient/commons-httpclient/3.1/commons-httpclient-3.1.jar

Dependency Hierarchy: - esapi-2.1.0.1.jar (Root Library) - antisamy-1.5.3.jar - :x: **commons-httpclient-3.1.jar** (Vulnerable Library)

Found in base branch: master

### Reachability Analysis

This vulnerability is potentially used ``` org.t246osslab.easybuggy.core.servlets.AbstractServlet (Application) -> org.owasp.esapi.ESAPI (Extension) -> org.owasp.esapi.reference.DefaultValidator (Extension) -> org.owasp.validator.css.ExternalCssScanner (Extension) ... -> org.apache.commons.httpclient.HostConfiguration (Extension) -> org.apache.commons.httpclient.protocol.Protocol (Extension) -> ❌ org.apache.commons.httpclient.protocol.SSLProtocolSocketFactory (Vulnerable Component) ```

### Vulnerability Details

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Publish Date: 2012-11-04

URL: CVE-2012-5783

### CVSS 2 Score Details (5.8)

Base Score Metrics not available

### Suggested Fix

Type: Upgrade version

Origin: https://exchange.xforce.ibmcloud.com/vulnerabilities/79984

Fix Resolution: Apply the appropriate patch for your system. See References.

CVE-2009-2625 ### Vulnerable Library - xercesImpl-2.8.0.jar

Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI), a complete framework for building parser components and configurations that is extremely modular and easy to program.

Library home page: http://xerces.apache.org/xerces2-j

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/xerces/xercesImpl/2.8.0/xercesImpl-2.8.0.jar

Dependency Hierarchy: - esapi-2.1.0.1.jar (Root Library) - xom-1.2.5.jar - :x: **xercesImpl-2.8.0.jar** (Vulnerable Library)

Found in base branch: master

### Reachability Analysis

This vulnerability is potentially used ``` org.t246osslab.easybuggy.core.servlets.AbstractServlet (Application) -> org.owasp.esapi.ESAPI (Extension) -> org.owasp.esapi.reference.DefaultValidator (Extension) -> org.apache.xerces.dom.DocumentImpl (Extension) ... -> org.apache.xerces.dom.CoreDOMImplementationImpl (Extension) -> org.apache.xerces.impl.dtd.XMLDTDLoader (Extension) -> ❌ org.apache.xerces.impl.XMLScanner (Vulnerable Component) ```

### Vulnerability Details

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.

Publish Date: 2009-08-06

URL: CVE-2009-2625

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2625

Release Date: 2009-08-06

Fix Resolution: xerces:xercesImpl:2.12.0

mend-local-app[bot] commented 1 year ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.