search

gate5 / struts-2.3.20

0 stars 0 forks source link

[Snyk] Fix for 17 vulnerabilities #301

Open snyk-bot opened 2 years ago

snyk-bot commented 2 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `maven` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Upgrade Breaking Change Exploit Maturity
low severity 466/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 2.9		 Information Exposure
SNYK-JAVA-JUNIT-1017047		 junit:junit:
4.8.2 -> 4.13.1
No Proof of Concept
medium severity 429/1000
Why? Has a fix available, CVSS 4.3		 Improper Output Neutralization for Logs
SNYK-JAVA-ORGSPRINGFRAMEWORK-2329097		 org.springframework:spring-webmvc-portlet:
3.0.5.RELEASE -> 4.3.15.RELEASE
No No Known Exploit
medium severity 429/1000
Why? Has a fix available, CVSS 4.3		 Improper Input Validation
SNYK-JAVA-ORGSPRINGFRAMEWORK-2330878		 org.springframework:spring-webmvc-portlet:
3.0.5.RELEASE -> 4.3.15.RELEASE
No No Known Exploit
high severity 579/1000
Why? Has a fix available, CVSS 7.3		 Expression Language Injection
SNYK-JAVA-ORGSPRINGFRAMEWORK-30157		 org.springframework:spring-webmvc-portlet:
3.0.5.RELEASE -> 4.3.15.RELEASE
No No Known Exploit
medium severity 529/1000
Why? Has a fix available, CVSS 6.3		 XML External Entity (XXE) Injection
SNYK-JAVA-ORGSPRINGFRAMEWORK-30160		 org.springframework:spring-webmvc-portlet:
3.0.5.RELEASE -> 4.3.15.RELEASE
No No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Cross-site Scripting (XSS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-30161		 org.springframework:spring-webmvc-portlet:
3.0.5.RELEASE -> 4.3.15.RELEASE
No No Known Exploit
medium severity 529/1000
Why? Has a fix available, CVSS 6.3		 XML External Entity (XXE) Injection
SNYK-JAVA-ORGSPRINGFRAMEWORK-30162		 org.springframework:spring-webmvc-portlet:
3.0.5.RELEASE -> 4.3.15.RELEASE
No No Known Exploit
high severity 654/1000
Why? Has a fix available, CVSS 8.8		 XML External Entity (XXE) Injection
SNYK-JAVA-ORGSPRINGFRAMEWORK-30163		 org.springframework:spring-webmvc-portlet:
3.0.5.RELEASE -> 4.3.15.RELEASE
No No Known Exploit
medium severity 429/1000
Why? Has a fix available, CVSS 4.3		 Cross-site Scripting (XSS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-30167		 org.springframework:spring-webmvc-portlet:
3.0.5.RELEASE -> 4.3.15.RELEASE
No No Known Exploit
medium severity 529/1000
Why? Has a fix available, CVSS 6.3		 Access Restriction Bypass
SNYK-JAVA-ORGSPRINGFRAMEWORK-31324		 org.springframework:spring-webmvc-portlet:
3.0.5.RELEASE -> 4.3.15.RELEASE
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Directory Traversal
SNYK-JAVA-ORGSPRINGFRAMEWORK-31325		 org.springframework:spring-webmvc-portlet:
3.0.5.RELEASE -> 4.3.15.RELEASE
No No Known Exploit
high severity 579/1000
Why? Has a fix available, CVSS 7.3		 Expression Language Injection
SNYK-JAVA-ORGSPRINGFRAMEWORK-31329		 org.springframework:spring-webmvc-portlet:
3.0.5.RELEASE -> 4.3.15.RELEASE
No No Known Exploit
medium severity 529/1000
Why? Has a fix available, CVSS 6.3		 XML External Entity (XXE) Injection
SNYK-JAVA-ORGSPRINGFRAMEWORK-31330		 org.springframework:spring-webmvc-portlet:
3.0.5.RELEASE -> 4.3.15.RELEASE
No No Known Exploit
medium severity 529/1000
Why? Has a fix available, CVSS 6.3		 Cross-site Request Forgery (CSRF)
SNYK-JAVA-ORGSPRINGFRAMEWORK-31331		 org.springframework:spring-webmvc-portlet:
3.0.5.RELEASE -> 4.3.15.RELEASE
No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Directory Traversal
SNYK-JAVA-ORGSPRINGFRAMEWORK-31332		 org.springframework:spring-webmvc-portlet:
3.0.5.RELEASE -> 4.3.15.RELEASE
No No Known Exploit
medium severity 429/1000
Why? Has a fix available, CVSS 4.3		 Cross-site Scripting (XSS)
SNYK-JAVA-ORGSPRINGFRAMEWORK-31512		 org.springframework:spring-webmvc-portlet:
3.0.5.RELEASE -> 4.3.15.RELEASE
No No Known Exploit
medium severity 509/1000
Why? Has a fix available, CVSS 5.9		 Directory Traversal
SNYK-JAVA-ORGSPRINGFRAMEWORK-32202		 org.springframework:spring-webmvc-portlet:
3.0.5.RELEASE -> 4.3.15.RELEASE
Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Vulnerabilities that could not be fixed

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Directory Traversal 🦉 Cross-site Scripting (XSS) 🦉 Cross-site Scripting (XSS) 🦉 More lessons are available in Snyk Learn