search

billmcchesney1 / foxtrot

A store abstraction and analytics system for real-time event data.
Apache License 2.0
0 stars 0 forks source link

CVE-2020-13959 (Medium) detected in velocity-tools-2.0.jar #302

Open mend-for-github-com[bot] opened 3 years ago

mend-for-github-com[bot] commented 3 years ago

CVE-2020-13959 - Medium Severity Vulnerability

Vulnerable Library - velocity-tools-2.0.jar

VelocityTools is an integrated collection of Velocity subprojects with the common goal of creating tools and infrastructure to speed and ease development of both web and non-web applications using the Velocity template engine.

Path to dependency file: /foxtrot-server/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/velocity/velocity-tools/2.0/velocity-tools-2.0.jar,/home/wss-scanner/.m2/repository/org/apache/velocity/velocity-tools/2.0/velocity-tools-2.0.jar,/home/wss-scanner/.m2/repository/org/apache/velocity/velocity-tools/2.0/velocity-tools-2.0.jar,/home/wss-scanner/.m2/repository/org/apache/velocity/velocity-tools/2.0/velocity-tools-2.0.jar,/home/wss-scanner/.m2/repository/org/apache/velocity/velocity-tools/2.0/velocity-tools-2.0.jar

Dependency Hierarchy: - foxtrot-common-6.3.1-7.jar (Root Library) - common-utils-1.4.jar - maven-dependency-plugin-3.1.1.jar - maven-reporting-impl-2.3.jar - doxia-site-renderer-1.4.jar - :x: **velocity-tools-2.0.jar** (Vulnerable Library)

Found in HEAD commit: ffb8a6014463ce8aac1bf6e7dc9a23fc4a2a8adc

Found in base branch: master

Vulnerability Details

The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.

Publish Date: 2021-03-10

URL: CVE-2020-13959

CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-fh63-4r66-jc7v

Release Date: 2021-03-10

Fix Resolution: org.apache.velocity.tools:velocity-tools-view:3.1

mend-for-github-com[bot] commented 1 year ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.