search

stefanfreitag / sht21

Other
0 stars 0 forks source link

CVE-2016-1000027 (High) detected in spring-web-5.2.2.RELEASE.jar #61

Closed mend-bolt-for-github[bot] closed 4 years ago

mend-bolt-for-github[bot] commented 4 years ago

CVE-2016-1000027 - High Severity Vulnerability

Vulnerable Library - spring-web-5.2.2.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /tmp/ws-scm/sht21/sht21-backend/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/5.2.2.RELEASE/d9b0a8079b7d604f134e3054127a7aeba65949a5/spring-web-5.2.2.RELEASE.jar,/root/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/5.2.2.RELEASE/d9b0a8079b7d604f134e3054127a7aeba65949a5/spring-web-5.2.2.RELEASE.jar

Dependency Hierarchy: - springdoc-openapi-ui-1.2.17.jar (Root Library) - springdoc-openapi-webmvc-core-1.2.17.jar - springdoc-openapi-common-1.2.17.jar - :x: **spring-web-5.2.2.RELEASE.jar** (Vulnerable Library)

Found in HEAD commit: af8cf7c21b332ed0c9f2b1ec142f84dadfe90057

Vulnerability Details

Pivotal Spring Framework 4.1.4 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.

Publish Date: 2020-01-02

URL: CVE-2016-1000027

CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here