Open mend-bolt-for-github[bot] opened 5 months ago
The uber-fast, ultra-lightweight classpath and module scanner for JVM languages.
Library home page: https://github.com/classgraph/classgraph
Path to dependency file: /chaincode/simple/java/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/io.github.classgraph/classgraph/4.8.47/6d4dfd3f9fdd1dcfd260bae7ad015fdb8b438a/classgraph-4.8.47.jar
Dependency Hierarchy: - fabric-chaincode-shim-1.4.8.jar (Root Library) - :x: **classgraph-4.8.47.jar** (Vulnerable Library)
Found in base branch: main
ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.
Publish Date: 2024-06-21
URL: CVE-2021-47621
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2021-47621
Release Date: 2024-06-21
Fix Resolution (io.github.classgraph:classgraph): 4.8.112
Direct dependency fix Resolution (org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim): 2.5.0
Step up your Open Source Security Game with Mend here
CVE-2021-47621 - High Severity Vulnerability
The uber-fast, ultra-lightweight classpath and module scanner for JVM languages.
Library home page: https://github.com/classgraph/classgraph
Path to dependency file: /chaincode/simple/java/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/io.github.classgraph/classgraph/4.8.47/6d4dfd3f9fdd1dcfd260bae7ad015fdb8b438a/classgraph-4.8.47.jar
Dependency Hierarchy: - fabric-chaincode-shim-1.4.8.jar (Root Library) - :x: **classgraph-4.8.47.jar** (Vulnerable Library)
Found in base branch: main
ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.
Publish Date: 2024-06-21
URL: CVE-2021-47621
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2021-47621
Release Date: 2024-06-21
Fix Resolution (io.github.classgraph:classgraph): 4.8.112
Direct dependency fix Resolution (org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim): 2.5.0
Step up your Open Source Security Game with Mend here