search

samqdemocorp-mend / box_mojito

https://github.com/box/mojito.git
Apache License 2.0
0 stars 0 forks source link

spring-boot-starter-data-jpa-1.3.5.RELEASE.jar: 6 vulnerabilities (highest severity is: 9.3) reachable #6

Open mend-for-github-com[bot] opened 8 months ago

mend-for-github-com[bot] commented 8 months ago
Vulnerable Library - spring-boot-starter-data-jpa-1.3.5.RELEASE.jar

Path to dependency file: /webapp/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/hibernate/hibernate-core/4.3.11.Final/hibernate-core-4.3.11.Final.jar

Found in HEAD commit: d4cbd8181219f9a6ad9908c6f748847b1efae670

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (spring-boot-starter-data-jpa version) Remediation Possible** Reachability
CVE-2018-1273 Critical 9.3 High 97.2% spring-data-commons-1.11.4.RELEASE.jar Transitive 1.5.11.RELEASE ✅

Reachable
CVE-2020-25638 Critical 9.1 Not Defined 0.4% hibernate-core-4.3.11.Final.jar Transitive 2.2.0.RELEASE ✅

Reachable
CVE-2018-1000632 High 8.7 Not Defined 0.3% dom4j-1.6.1.jar Transitive 2.0.9.RELEASE ✅

Reachable
CVE-2016-6652 Medium 6.3 Not Defined 0.2% spring-data-jpa-1.9.4.RELEASE.jar Transitive 1.4.0.RELEASE ✅

Reachable
CVE-2020-10683 Critical 9.3 Not Defined 0.70000005% dom4j-1.6.1.jar Transitive 2.0.9.RELEASE ✅

Unreachable
CVE-2019-14900 High 7.1 Not Defined 0.1% hibernate-core-4.3.11.Final.jar Transitive 2.0.0.RELEASE ✅

Unreachable

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2018-1273 ### Vulnerable Library - spring-data-commons-1.11.4.RELEASE.jar

Global parent pom.xml to be used by Spring Data modules

Library home page: http://www.spring.io/spring-data

Path to dependency file: /webapp/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/data/spring-data-commons/1.11.4.RELEASE/spring-data-commons-1.11.4.RELEASE.jar

Dependency Hierarchy: - spring-boot-starter-data-jpa-1.3.5.RELEASE.jar (Root Library) - spring-data-jpa-1.9.4.RELEASE.jar - :x: **spring-data-commons-1.11.4.RELEASE.jar** (Vulnerable Library)

Found in HEAD commit: d4cbd8181219f9a6ad9908c6f748847b1efae670

Found in base branch: main

### Reachability Analysis This vulnerability is potentially reachable ``` com.box.l10n.mojito.rest.images.ImageWS (Application) -> org.springframework.boot.actuate.autoconfigure.EndpointWebMvcChildContextConfiguration$CompositeHandlerMapping (Extension) -> org.springframework.boot.actuate.autoconfigure.EndpointWebMvcChildContextConfiguration (Extension) -> org.springframework.web.servlet.config.annotation.EnableWebMvc (Extension) ... -> org.springframework.data.web.ProxyingHandlerMethodArgumentResolver (Extension) -> org.springframework.data.web.MapDataBinder (Extension) -> ❌ org.springframework.data.web.MapDataBinder$MapPropertyAccessor (Vulnerable Component) ```

### Vulnerability Details

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

Publish Date: 2018-04-10

URL: CVE-2018-1273

### Threat Assessment

Exploit Maturity: High

EPSS: 97.2%

### CVSS 4 Score Details (9.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A

For more information on CVSS4 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://tanzu.vmware.com/security/cve-2018-1273

Release Date: 2018-04-10

Fix Resolution (org.springframework.data:spring-data-commons): 1.13.11.RELEASE

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-jpa): 1.5.11.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2020-25638 ### Vulnerable Library - hibernate-core-4.3.11.Final.jar

The core O/RM functionality as provided by Hibernate

Library home page: http://hibernate.org

Path to dependency file: /webapp/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/hibernate/hibernate-core/4.3.11.Final/hibernate-core-4.3.11.Final.jar

Dependency Hierarchy: - spring-boot-starter-data-jpa-1.3.5.RELEASE.jar (Root Library) - hibernate-entitymanager-4.3.11.Final.jar - :x: **hibernate-core-4.3.11.Final.jar** (Vulnerable Library)

Found in HEAD commit: d4cbd8181219f9a6ad9908c6f748847b1efae670

Found in base branch: main

### Reachability Analysis This vulnerability is potentially reachable ``` com.box.l10n.mojito.service.eventlistener.HibernateEventListenerConfig (Application) -> org.hibernate.internal.SessionFactoryImpl (Extension) -> org.hibernate.engine.query.spi.HQLQueryPlan (Extension) -> org.hibernate.engine.query.spi.EntityGraphQueryHint (Extension) -> org.hibernate.hql.internal.ast.tree.FromElementFactory (Extension) -> ❌ org.hibernate.hql.internal.ast.tree.DotNode (Vulnerable Component) ```

### Vulnerability Details

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.

Publish Date: 2020-12-02

URL: CVE-2020-25638

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.4%

### CVSS 4 Score Details (9.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A

For more information on CVSS4 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://in.relation.to/2020/11/19/hibernate-orm-5424-final-release/

Release Date: 2020-12-02

Fix Resolution (org.hibernate:hibernate-core): 5.3.20.Final

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-jpa): 2.2.0.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2018-1000632 ### Vulnerable Library - dom4j-1.6.1.jar

dom4j: the flexible XML framework for Java

Library home page: http://sourceforge.net/projects/dom4j

Path to dependency file: /webapp/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/dom4j/dom4j/1.6.1/dom4j-1.6.1.jar

Dependency Hierarchy: - spring-boot-starter-data-jpa-1.3.5.RELEASE.jar (Root Library) - hibernate-entitymanager-4.3.11.Final.jar - hibernate-core-4.3.11.Final.jar - :x: **dom4j-1.6.1.jar** (Vulnerable Library)

Found in HEAD commit: d4cbd8181219f9a6ad9908c6f748847b1efae670

Found in base branch: main

### Reachability Analysis This vulnerability is potentially reachable ``` com.box.l10n.mojito.service.eventlistener.HibernateEventListenerConfig (Application) -> org.hibernate.internal.SessionFactoryImpl (Extension) -> org.hibernate.cfg.Configuration (Extension) -> org.hibernate.internal.util.xml.XMLHelper (Extension) -> org.dom4j.DocumentFactory (Extension) -> ❌ org.dom4j.QName (Vulnerable Component) ```

### Vulnerability Details

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

Publish Date: 2018-08-20

URL: CVE-2018-1000632

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.3%

### CVSS 4 Score Details (8.7)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A

For more information on CVSS4 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000632/

Release Date: 2018-08-20

Fix Resolution (dom4j:dom4j): 20040902.021138

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-jpa): 2.0.9.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2016-6652 ### Vulnerable Library - spring-data-jpa-1.9.4.RELEASE.jar

Spring Data module for JPA repositories.

Library home page: http://projects.spring.io/spring-data-jpa

Path to dependency file: /webapp/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/data/spring-data-jpa/1.9.4.RELEASE/spring-data-jpa-1.9.4.RELEASE.jar

Dependency Hierarchy: - spring-boot-starter-data-jpa-1.3.5.RELEASE.jar (Root Library) - :x: **spring-data-jpa-1.9.4.RELEASE.jar** (Vulnerable Library)

Found in HEAD commit: d4cbd8181219f9a6ad9908c6f748847b1efae670

Found in base branch: main

### Reachability Analysis This vulnerability is potentially reachable ``` com.box.l10n.mojito.rest.security.UserWS (Application) -> ❌ org.springframework.data.jpa.domain.JpaSort (Vulnerable Component) ```

### Vulnerability Details

SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.

Publish Date: 2016-10-05

URL: CVE-2016-6652

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

### CVSS 4 Score Details (6.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A

For more information on CVSS4 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6652

Release Date: 2016-10-05

Fix Resolution (org.springframework.data:spring-data-jpa): 1.9.6.RELEASE

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-jpa): 1.4.0.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2020-10683 ### Vulnerable Library - dom4j-1.6.1.jar

dom4j: the flexible XML framework for Java

Library home page: http://sourceforge.net/projects/dom4j

Path to dependency file: /webapp/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/dom4j/dom4j/1.6.1/dom4j-1.6.1.jar

Dependency Hierarchy: - spring-boot-starter-data-jpa-1.3.5.RELEASE.jar (Root Library) - hibernate-entitymanager-4.3.11.Final.jar - hibernate-core-4.3.11.Final.jar - :x: **dom4j-1.6.1.jar** (Vulnerable Library)

Found in HEAD commit: d4cbd8181219f9a6ad9908c6f748847b1efae670

Found in base branch: main

### Reachability Analysis

The vulnerable code is unreachable

### Vulnerability Details

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Publish Date: 2020-05-01

URL: CVE-2020-10683

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.70000005%

### CVSS 4 Score Details (9.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A

For more information on CVSS4 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2024-09-03

Fix Resolution (dom4j:dom4j): 20040902.021138

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-jpa): 2.0.9.RELEASE

In order to enable automatic remediation, please create workflow rules

CVE-2019-14900 ### Vulnerable Library - hibernate-core-4.3.11.Final.jar

The core O/RM functionality as provided by Hibernate

Library home page: http://hibernate.org

Path to dependency file: /webapp/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/hibernate/hibernate-core/4.3.11.Final/hibernate-core-4.3.11.Final.jar

Dependency Hierarchy: - spring-boot-starter-data-jpa-1.3.5.RELEASE.jar (Root Library) - hibernate-entitymanager-4.3.11.Final.jar - :x: **hibernate-core-4.3.11.Final.jar** (Vulnerable Library)

Found in HEAD commit: d4cbd8181219f9a6ad9908c6f748847b1efae670

Found in base branch: main

### Reachability Analysis

The vulnerable code is unreachable

### Vulnerability Details

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.

Publish Date: 2020-07-06

URL: CVE-2019-14900

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

### CVSS 4 Score Details (7.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A

For more information on CVSS4 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14900

Release Date: 2020-07-06

Fix Resolution (org.hibernate:hibernate-core): 5.1.10.Final

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-jpa): 2.0.0.RELEASE

In order to enable automatic remediation, please create workflow rules

In order to enable automatic remediation for this issue, please create workflow rules