search

snowdensb / nifi

Apache NiFi
https://nifi.apache.org/
Apache License 2.0
0 stars 0 forks source link

spring-security-saml2-core-1.0.10.RELEASE.jar: 13 vulnerabilities (highest severity is: 9.8) - autoclosed #560

Closed mend-for-github-com[bot] closed 3 days ago

mend-for-github-com[bot] commented 4 weeks ago
Vulnerable Library - spring-security-saml2-core-1.0.10.RELEASE.jar

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (spring-security-saml2-core version) Remediation Possible** Reachability
CVE-2019-13116 Critical 9.8 commons-collections-3.2.1.jar Transitive N/A* ❌
CVE-2017-15708 Critical 9.8 commons-collections-3.2.1.jar Transitive N/A* ❌
CVE-2015-7501 Critical 9.8 commons-collections-3.2.1.jar Transitive N/A* ❌
CVE-2015-4852 Critical 9.8 commons-collections-3.2.1.jar Transitive N/A* ❌
CVE-2020-13936 High 8.8 velocity-engine-core-2.0.jar Transitive N/A* ❌
WS-2023-0388 High 7.5 esapi-2.2.0.0.jar Transitive N/A* ❌
CVE-2022-23457 High 7.5 esapi-2.2.0.0.jar Transitive N/A* ❌
CVE-2021-40690 High 7.5 xmlsec-1.5.8.jar Transitive N/A* ❌
CVE-2015-6420 High 7.3 commons-collections-3.2.1.jar Transitive N/A* ❌
CVE-2022-23437 Medium 6.5 xercesImpl-2.12.0.jar Transitive N/A* ❌
WS-2023-0429 Medium 6.1 esapi-2.2.0.0.jar Transitive N/A* ❌
CVE-2022-24891 Medium 5.4 esapi-2.2.0.0.jar Transitive N/A* ❌
CVE-2012-5783 Medium 4.8 commons-httpclient-3.1.jar Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-13116 ### Vulnerable Library - commons-collections-3.2.1.jar

Types that extend and augment the Java Collections Framework.

Library home page: http://www.apache.org/

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-server-nar/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar

Dependency Hierarchy: - spring-security-saml2-core-1.0.10.RELEASE.jar (Root Library) - opensaml-2.6.6.jar - :x: **commons-collections-3.2.1.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

The MuleSoft Mule Community Edition runtime engine before 3.8 allows remote attackers to execute arbitrary code because of Java Deserialization, related to Apache Commons Collections

Publish Date: 2019-10-16

URL: CVE-2019-13116

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13116

Release Date: 2019-10-16

Fix Resolution: commons-collections:commons-collections:3.2.2

CVE-2017-15708 ### Vulnerable Library - commons-collections-3.2.1.jar

Types that extend and augment the Java Collections Framework.

Library home page: http://www.apache.org/

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-server-nar/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar

Dependency Hierarchy: - spring-security-saml2-core-1.0.10.RELEASE.jar (Root Library) - opensaml-2.6.6.jar - :x: **commons-collections-3.2.1.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.

Publish Date: 2017-12-11

URL: CVE-2017-15708

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15708

Release Date: 2017-12-11

Fix Resolution: org.apache.synapse:Apache-Synapse:3.0.1;commons-collections:commons-collections:3.2.2

CVE-2015-7501 ### Vulnerable Library - commons-collections-3.2.1.jar

Types that extend and augment the Java Collections Framework.

Library home page: http://www.apache.org/

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-server-nar/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar

Dependency Hierarchy: - spring-security-saml2-core-1.0.10.RELEASE.jar (Root Library) - opensaml-2.6.6.jar - :x: **commons-collections-3.2.1.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Publish Date: 2017-11-09

URL: CVE-2015-7501

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1279330

Release Date: 2017-11-09

Fix Resolution: commons-collections:commons-collections:3.2.2;org.apache.commons:commons-collections4:4.1

CVE-2015-4852 ### Vulnerable Library - commons-collections-3.2.1.jar

Types that extend and augment the Java Collections Framework.

Library home page: http://www.apache.org/

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-server-nar/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar

Dependency Hierarchy: - spring-security-saml2-core-1.0.10.RELEASE.jar (Root Library) - opensaml-2.6.6.jar - :x: **commons-collections-3.2.1.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.

Publish Date: 2015-11-18

URL: CVE-2015-4852

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.openwall.com/lists/oss-security/2015/11/17/19

Release Date: 2015-11-18

Fix Resolution: commons-collections:commons-collections:3.2.2

CVE-2020-13936 ### Vulnerable Library - velocity-engine-core-2.0.jar

Apache Velocity is a general purpose template engine.

Library home page: https://www.apache.org/

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-optimistic-locking/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/velocity/velocity-engine-core/2.0/velocity-engine-core-2.0.jar,/home/wss-scanner/.m2/repository/org/apache/velocity/velocity-engine-core/2.0/velocity-engine-core-2.0.jar,/home/wss-scanner/.m2/repository/org/apache/velocity/velocity-engine-core/2.0/velocity-engine-core-2.0.jar,/home/wss-scanner/.m2/repository/org/apache/velocity/velocity-engine-core/2.0/velocity-engine-core-2.0.jar,/home/wss-scanner/.m2/repository/org/apache/velocity/velocity-engine-core/2.0/velocity-engine-core-2.0.jar,/home/wss-scanner/.m2/repository/org/apache/velocity/velocity-engine-core/2.0/velocity-engine-core-2.0.jar

Dependency Hierarchy: - spring-security-saml2-core-1.0.10.RELEASE.jar (Root Library) - :x: **velocity-engine-core-2.0.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

Publish Date: 2021-03-10

URL: CVE-2020-13936

### CVSS 3 Score Details (8.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2021-03-10

Fix Resolution: org.apache.velocity:velocity-engine-core:2.3

WS-2023-0388 ### Vulnerable Library - esapi-2.2.0.0.jar

The Enterprise Security API (ESAPI) project is an OWASP project to create simple strong security controls for every web platform. Security controls are not simple to build. You can read about the hundreds of pitfalls for unwary developers on the OWASP web site. By providing developers with a set of strong controls, we aim to eliminate some of the complexity of creating secure web applications. This can result in significant cost savings across the SDLC.

Library home page: http://www.owasp.org/index.php

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar

Dependency Hierarchy: - spring-security-saml2-core-1.0.10.RELEASE.jar (Root Library) - :x: **esapi-2.2.0.0.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

ESAPI 2.5.2.0 and later addressed the DoS vulnerability described in CVE-2023-24998, which Apache Commons FileUpload 1.5 attempted to remediate. But while writing up a new security bulletin regarding the impact on the affected ESAPI HTTPUtilities.getFileUploads methods (or more specifically those methods in the DefaultHTTPUtilities implementation class), I realized that a DoS vulnerability still persists in ESAPI and for that matter in Apache Commons FileUpload as well.

Publish Date: 2023-10-28

URL: WS-2023-0388

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-7c2q-5qmr-v76q

Release Date: 2023-10-28

Fix Resolution: org.owasp.esapi:esapi:2.5.2.0

CVE-2022-23457 ### Vulnerable Library - esapi-2.2.0.0.jar

The Enterprise Security API (ESAPI) project is an OWASP project to create simple strong security controls for every web platform. Security controls are not simple to build. You can read about the hundreds of pitfalls for unwary developers on the OWASP web site. By providing developers with a set of strong controls, we aim to eliminate some of the complexity of creating secure web applications. This can result in significant cost savings across the SDLC.

Library home page: http://www.owasp.org/index.php

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar

Dependency Hierarchy: - spring-security-saml2-core-1.0.10.RELEASE.jar (Root Library) - :x: **esapi-2.2.0.0.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this.

Publish Date: 2022-04-25

URL: CVE-2022-23457

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-8m5h-hrqm-pxm2

Release Date: 2022-04-25

Fix Resolution: org.owasp.esapi:esapi:2.3.0.0

CVE-2021-40690 ### Vulnerable Library - xmlsec-1.5.8.jar

Apache XML Security for Java supports XML-Signature Syntax and Processing, W3C Recommendation 12 February 2002, and XML Encryption Syntax and Processing, W3C Recommendation 10 December 2002. As of version 1.4, the library supports the standard Java API JSR-105: XML Digital Signature APIs.

Library home page: http://www.apache.org/

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/santuario/xmlsec/1.5.8/xmlsec-1.5.8.jar,/home/wss-scanner/.m2/repository/org/apache/santuario/xmlsec/1.5.8/xmlsec-1.5.8.jar,/home/wss-scanner/.m2/repository/org/apache/santuario/xmlsec/1.5.8/xmlsec-1.5.8.jar,/home/wss-scanner/.m2/repository/org/apache/santuario/xmlsec/1.5.8/xmlsec-1.5.8.jar,/home/wss-scanner/.m2/repository/org/apache/santuario/xmlsec/1.5.8/xmlsec-1.5.8.jar,/home/wss-scanner/.m2/repository/org/apache/santuario/xmlsec/1.5.8/xmlsec-1.5.8.jar

Dependency Hierarchy: - spring-security-saml2-core-1.0.10.RELEASE.jar (Root Library) - :x: **xmlsec-1.5.8.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.

Publish Date: 2021-09-19

URL: CVE-2021-40690

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40690

Release Date: 2021-09-19

Fix Resolution: org.apache.santuario:xmlsec:2.1.7, 2.2.3

CVE-2015-6420 ### Vulnerable Library - commons-collections-3.2.1.jar

Types that extend and augment the Java Collections Framework.

Library home page: http://www.apache.org/

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-server-nar/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar,/home/wss-scanner/.m2/repository/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar

Dependency Hierarchy: - spring-security-saml2-core-1.0.10.RELEASE.jar (Root Library) - opensaml-2.6.6.jar - :x: **commons-collections-3.2.1.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Publish Date: 2015-12-15

URL: CVE-2015-6420

### CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2015-12-15

Fix Resolution: commons-collections:commons-collections3.2.2,org.apache.commons:commons-collections4:4.1

CVE-2022-23437 ### Vulnerable Library - xercesImpl-2.12.0.jar

Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI), a complete framework for building parser components and configurations that is extremely modular and easy to program. The Apache Xerces2 parser is the reference implementation of XNI but other parser components, configurations, and parsers can be written using the Xerces Native Interface. For complete design and implementation documents, refer to the XNI Manual. Xerces2 is a fully conforming XML Schema 1.0 processor. A partial experimental implementation of the XML Schema 1.1 Structures and Datatypes Working Drafts (December 2009) and an experimental implementation of the XML Schema Definition Language (XSD): Component Designators (SCD) Candidate Recommendation (January 2010) are provided for evaluation. For more information, refer to the XML Schema page. Xerces2 also provides a complete implementation of the Document Object Model Level 3 Core and Load/Save W3C Recommendations and provides a complete implementation of the XML Inclusions (XInclude) W3C Recommendation. It also provides support for OASIS XML Catalogs v1.1. Xerces2 is able to parse documents written according to the XML 1.1 Recommendation, except that it does not yet provide an option to enable normalization checking as described in section 2.13 of this specification. It also handles namespaces according to the XML Namespaces 1.1 Recommendation, and will correctly serialize XML 1.1 documents if the DOM level 3 load/save APIs are in use.

Library home page: https://xerces.apache.org/xerces2-j/

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-optimistic-locking/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/xerces/xercesImpl/2.12.0/xercesImpl-2.12.0.jar,/home/wss-scanner/.m2/repository/xerces/xercesImpl/2.12.0/xercesImpl-2.12.0.jar,/home/wss-scanner/.m2/repository/xerces/xercesImpl/2.12.0/xercesImpl-2.12.0.jar,/home/wss-scanner/.m2/repository/xerces/xercesImpl/2.12.0/xercesImpl-2.12.0.jar,/home/wss-scanner/.m2/repository/xerces/xercesImpl/2.12.0/xercesImpl-2.12.0.jar,/home/wss-scanner/.m2/repository/xerces/xercesImpl/2.12.0/xercesImpl-2.12.0.jar

Dependency Hierarchy: - spring-security-saml2-core-1.0.10.RELEASE.jar (Root Library) - esapi-2.2.0.0.jar - :x: **xercesImpl-2.12.0.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Publish Date: 2022-01-24

URL: CVE-2022-23437

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-h65f-jvqw-m9fj

Release Date: 2022-01-24

Fix Resolution: xerces:xercesImpl:2.12.2

WS-2023-0429 ### Vulnerable Library - esapi-2.2.0.0.jar

The Enterprise Security API (ESAPI) project is an OWASP project to create simple strong security controls for every web platform. Security controls are not simple to build. You can read about the hundreds of pitfalls for unwary developers on the OWASP web site. By providing developers with a set of strong controls, we aim to eliminate some of the complexity of creating secure web applications. This can result in significant cost savings across the SDLC.

Library home page: http://www.owasp.org/index.php

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar

Dependency Hierarchy: - spring-security-saml2-core-1.0.10.RELEASE.jar (Root Library) - :x: **esapi-2.2.0.0.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

The Validator.isValidSafeHTML method can result in false negatives where it reports some input as safe (i.e., returns true), but really isn't, and using that same input as-is can in certain circumstances result in XSS vulnerabilities. Because this method cannot be fixed, it is being deprecated and will be removed in one years time from when this advisory is published. Note that all versions of ESAPI, that have this method (which dates back to at least the ESAPI 1.3 release more than 15 years ago) have this issue and it will continue to exist until these two methods are removed in a future ESAPI release.

Publish Date: 2023-11-24

URL: WS-2023-0429

### CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-r68h-jhhj-9jvm

Release Date: 2023-11-24

Fix Resolution: no_fix

CVE-2022-24891 ### Vulnerable Library - esapi-2.2.0.0.jar

The Enterprise Security API (ESAPI) project is an OWASP project to create simple strong security controls for every web platform. Security controls are not simple to build. You can read about the hundreds of pitfalls for unwary developers on the OWASP web site. By providing developers with a set of strong controls, we aim to eliminate some of the complexity of creating secure web applications. This can result in significant cost savings across the SDLC.

Library home page: http://www.owasp.org/index.php

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar,/home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.2.0.0/esapi-2.2.0.0.jar

Dependency Hierarchy: - spring-security-saml2-core-1.0.10.RELEASE.jar (Root Library) - :x: **esapi-2.2.0.0.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause "javascript:" URLs to fail to be correctly sanitized. This issue is patched in ESAPI 2.3.0.0. As a workaround, manually edit the **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression. More information about remediation of the vulnerability, including the workaround, is available in the maintainers' release notes and security bulletin.

Publish Date: 2022-04-27

URL: CVE-2022-24891

### CVSS 3 Score Details (5.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-q77q-vx4q-xx6q

Release Date: 2022-04-27

Fix Resolution: org.owasp.esapi:esapi:2.3.0.0

CVE-2012-5783 ### Vulnerable Library - commons-httpclient-3.1.jar

The HttpClient component supports the client-side of RFC 1945 (HTTP/1.0) and RFC 2616 (HTTP/1.1) , several related specifications (RFC 2109 (Cookies) , RFC 2617 (HTTP Authentication) , etc.), and provides a framework by which new request types (methods) or HTTP extensions can be created easily.

Library home page: http://jakarta.apache.org/

Path to dependency file: /nifi-toolkit/nifi-toolkit-admin/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-httpclient/commons-httpclient/3.1/commons-httpclient-3.1.jar,/home/wss-scanner/.m2/repository/commons-httpclient/commons-httpclient/3.1/commons-httpclient-3.1.jar,/home/wss-scanner/.m2/repository/commons-httpclient/commons-httpclient/3.1/commons-httpclient-3.1.jar,/home/wss-scanner/.m2/repository/commons-httpclient/commons-httpclient/3.1/commons-httpclient-3.1.jar,/home/wss-scanner/.m2/repository/commons-httpclient/commons-httpclient/3.1/commons-httpclient-3.1.jar,/home/wss-scanner/.m2/repository/commons-httpclient/commons-httpclient/3.1/commons-httpclient-3.1.jar,/home/wss-scanner/.m2/repository/commons-httpclient/commons-httpclient/3.1/commons-httpclient-3.1.jar,/home/wss-scanner/.m2/repository/commons-httpclient/commons-httpclient/3.1/commons-httpclient-3.1.jar

Dependency Hierarchy: - spring-security-saml2-core-1.0.10.RELEASE.jar (Root Library) - not-going-to-be-commons-ssl-0.3.20.jar - :x: **commons-httpclient-3.1.jar** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Publish Date: 2012-11-04

URL: CVE-2012-5783

### CVSS 3 Score Details (4.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-5783

Release Date: 2012-11-04

Fix Resolution: commons-httpclient:commons-httpclient - 3.1-jenkins-1,3.1-redhat-3,3.1-HTTPCLIENT-1265

mend-for-github-com[bot] commented 3 days ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.