Fix OWASP Critical Vulnerability from dependency xmlbeans-2.6.0.jar

onc-healthit / code-validator-api

Source code for the Vocabulary Validator API and Service

Other

7 stars 30 forks source link

Fix OWASP Critical Vulnerability from dependency xmlbeans-2.6.0.jar #114

Open SoumyajitPatra opened 2 years ago

SoumyajitPatra commented 2 years ago

Dependency: xmlbeans-2.6.0.jar Vulnerability IDs: cpe:2.3:a:apache:xmlbeans:2.6.0:::::::* Package: pkg:maven/org.apache.xmlbeans/xmlbeans@2.6.0 Highest Severity: CRITICAL

xmlbeans@2.6.0 is introduced by poi-ooxml@3.17. On upgrading to poi-ooxml@4.0.0 we get xmlbeans@3.0.0 which does not have any OWASP vulnerability