[Apiiro] 2 risks

[apiiro-staging[bot]]

Discovered on: Jan 15, 2024 09:54
Dependency: log4j:log4j
Version: 1.2.12
Type: Direct
Introduced through:

• log4j:log4j: 1.2.12

Vulnerabilities

• JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data with CVSS score 7.5.
• Deserialization of Untrusted Data in Log4j with CVSS score 9.8.
• SQL Injection in Log4j 1.2.x with CVSS score 9.8.
• Deserialization of Untrusted Data in Apache Log4j with CVSS score 8.8.
• Deserialization of Untrusted Data in Log4j 1.x with CVSS score 8.8.

About this package:

External dependency: log4j:log4j - http://logging.apache.org/log4j/1.2/
Package details: Apache Log4j 1.2
Latest version: 1.2.17
License: Apache-2.0
Insights:

• Backed by foundation - This package is backed by a respected OSS foundation and adheres to its maintenance standards
• Current CVE - A CVE on this package has not been fixed by an official release/patch
• Not fixable - This package includes a CVE that has not been fixed by an official release or patch
• Has vulnerabilities - One or more vulnerabilities have been reported for this package
• Used in code - This dependency is used in code:

common/src/main/java/org/broadleafcommerce/common/cache/Log4jStatisticsServiceLogAdapter.java
common/src/main/java/org/broadleafcommerce/common/logging/Log4jManagementBean.java

This is a sub-dependency

In order to update its version, you may need to upgrade the following top-level dependencies:

• org.broadleafcommerce:broadleaf-common (Dependency declared in pom.xml)
• org.apache.solr:solr-core (Dependency declared in pom.xml)

View in Apiiro

Discovered on: Jan 15, 2024 09:50
Dependency: org.thymeleaf.extras:thymeleaf-extras-springsecurity5
Version:
Type: Direct
Introduced through:

• org.thymeleaf.extras:thymeleaf-extras-springsecurity5: 3.0.4.RELEASE

About this package:

External dependency: org.thymeleaf.extras:thymeleaf-extras-springsecurity5 - http://www.thymeleaf.org
Latest version: 3.1.2.RELEASE
License: Apache-2.0
Insights:

• Backed by foundation - This package is backed by a respected OSS foundation and adheres to its maintenance standards
• Used in code - This dependency is used in code:

src/main/java/org/owasp/webgoat/container/MvcConfiguration.java

View in Apiiro