Closed mend-bolt-for-github[bot] closed 12 months ago
Initial Review: The actual vulnerability requires a malicious WAR file to be imported directly into the application. I don't know of any places where that could happen in Moqui without serious privileges, and at that point you're hosed anyway.
This also requires a major version bump for the fix, which may break things internally.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
WS-2023-0236 - Low Severity Vulnerability
jetty-xml-10.0.13.jar
The jetty xml utilities.
Library home page: https://eclipse.org/jetty
Dependency Hierarchy: - jetty-webapp-10.0.13.jar (Root Library) - :x: **jetty-xml-10.0.13.jar** (Vulnerable Library)
jetty-xml-10.0.15.jar
The jetty xml utilities.
Library home page: https://eclipse.org/jetty
Path to dependency file: /framework/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.eclipse.jetty/jetty-xml/10.0.15/d30d139b35bf183757b7ef5372dec5096bc39a60/jetty-xml-10.0.15.jar
Dependency Hierarchy: - jetty-webapp-10.0.15.jar (Root Library) - :x: **jetty-xml-10.0.15.jar** (Vulnerable Library)
Found in HEAD commit: fba80060556fe669c01984490e98eaf6c45f9b5d
Found in base branch: master
XmlParser is vulnerable to XML external entity (XXE) vulnerability. XmlParser is being used when parsing Jetty’s xml configuration files. An attacker might exploit this vulnerability in order to achieve SSRF or cause a denial of service. One possible scenario is importing a (remote) malicious WAR into a Jetty’s server, while the WAR includes a malicious web.xml. The vulnerability is patched in versions 10.0.16, 11.0.16, and 12.0.0.
Publish Date: 2023-07-10
URL: WS-2023-0236
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: High - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/eclipse/jetty.project/security/advisories/GHSA-58qw-p7qm-5rvh
Release Date: 2023-07-10
Fix Resolution (org.eclipse.jetty:jetty-xml): 11.0.0-alpha0
Direct dependency fix Resolution (org.eclipse.jetty:jetty-webapp): 11.0.0
Fix Resolution (org.eclipse.jetty:jetty-xml): 11.0.0-alpha0
Direct dependency fix Resolution (org.eclipse.jetty:jetty-webapp): 11.0.0
Step up your Open Source Security Game with Mend here