Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

 Sponsor

Project: SteelBlue - JavaFX Bindings

it.tidalwave.steelblue:it-tidalwave-role-ui-javafx:1.1-ALPHA-3

Scan Information (show all):

Summary

Display: Showing Vulnerable Dependencies (click to show all)

DependencyVulnerability IDsPackageHighest SeverityCVE CountConfidenceEvidence Count
it-tidalwave-role-3.2-ALPHA-23.jarpkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-role@3.2-ALPHA-23 024
it-tidalwave-util-3.2-ALPHA-23.jarpkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-util@3.2-ALPHA-23 024
javafx-base-11.0.1-mac.jarpkg:maven/org.openjfx/javafx-base@11.0.1 010
javafx-base-11.0.1.jarpkg:maven/org.openjfx/javafx-base@11.0.1 013
javafx-controls-11.0.1-mac.jarpkg:maven/org.openjfx/javafx-controls@11.0.1 012
javafx-controls-11.0.1.jarpkg:maven/org.openjfx/javafx-controls@11.0.1 013
javafx-fxml-11.0.1-mac.jarpkg:maven/org.openjfx/javafx-fxml@11.0.1 010
javafx-fxml-11.0.1.jarpkg:maven/org.openjfx/javafx-fxml@11.0.1 013
javafx-graphics-11.0.1-mac.jarcpe:2.3:a:oracle:javafx:11.0.1:*:*:*:*:*:*:*pkg:maven/org.openjfx/javafx-graphics@11.0.1 0Low10
javafx-graphics-11.0.1-mac.jar: javafx-swt.jar 07
javafx-graphics-11.0.1.jarpkg:maven/org.openjfx/javafx-graphics@11.0.1 013
javax.annotation-api-1.3.2.jarpkg:maven/javax.annotation/javax.annotation-api@1.3.2 048
javax.inject-1.jarpkg:maven/javax.inject/javax.inject@1 020
jsr305-3.0.2.jarpkg:maven/com.google.code.findbugs/jsr305@3.0.2 017
lombok-1.18.24.jarpkg:maven/org.projectlombok/lombok@1.18.24 036
lombok-1.18.24.jar: mavenEcjBootstrapAgent.jar 07
slf4j-api-2.0.7.jarpkg:maven/org.slf4j/slf4j-api@2.0.7 031
spotbugs-annotations-3.1.9.jarpkg:maven/com.github.spotbugs/spotbugs-annotations@3.1.9 053
spring-core-4.3.30.RELEASE.jarcpe:2.3:a:pivotal_software:spring_framework:4.3.30:release:*:*:*:*:*:*
cpe:2.3:a:springsource:spring_framework:4.3.30:release:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_framework:4.3.30:release:*:*:*:*:*:*
pkg:maven/org.springframework/spring-core@4.3.30.RELEASECRITICAL*5Highest34
spring-expression-4.3.30.RELEASE.jarcpe:2.3:a:pivotal_software:spring_framework:4.3.30:release:*:*:*:*:*:*
cpe:2.3:a:springsource:spring_framework:4.3.30:release:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_framework:4.3.30:release:*:*:*:*:*:*
pkg:maven/org.springframework/spring-expression@4.3.30.RELEASECRITICAL*7Highest34

* indicates the dependency has a known exploited vulnerability

Dependencies

it-tidalwave-role-3.2-ALPHA-23.jar

Description:

        Roles are a powerful way for designing complex behaviours while keeping good practices such as Single Responsibility, Dependency Inversion and
        Interface Segregation.
    

File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/it/tidalwave/thesefoolishthings/it-tidalwave-role/3.2-ALPHA-23/it-tidalwave-role-3.2-ALPHA-23.jar
MD5: 37f0daee422c452ebe1a056f3e33d566
SHA1: afcce55ee9a0a52285c6ab13a6f61c4e8f667db7
SHA256:dc43792db69cb53f1341d33d8517ef99c45ce356f55b105227f532c8012e7bd9
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile
it-tidalwave-role-3.2-ALPHA-23.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-role-ui-javafx@1.1-ALPHA-3

Identifiers

it-tidalwave-util-3.2-ALPHA-23.jar

Description:

        A collection of common utilities.
    

File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/it/tidalwave/thesefoolishthings/it-tidalwave-util/3.2-ALPHA-23/it-tidalwave-util-3.2-ALPHA-23.jar
MD5: 021b41e778533aa2700c52873b0b0b75
SHA1: 1ed40423e696ec50058f9c3ccb3a468c05fcb5cf
SHA256:4fea0bf9e195da5db90a3b675562dcdbfe98a058e04e324c846f31d6991e3327
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile
it-tidalwave-util-3.2-ALPHA-23.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-role-ui-javafx@1.1-ALPHA-3

Identifiers

javafx-base-11.0.1-mac.jar

File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/openjfx/javafx-base/11.0.1/javafx-base-11.0.1-mac.jar
MD5: 94933060e439fba99478e14fcf2d1b02
SHA1: 2b9ca67aea06b0ea7aa0e740498fc97c822b307e
SHA256:2d8052a08fd2e5d98e1d5a16d724ea5dd02102879de20a193225f57199803983
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile
javafx-base-11.0.1-mac.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.openjfx/javafx-base@11.0.1

Identifiers

javafx-base-11.0.1.jar

File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/openjfx/javafx-base/11.0.1/javafx-base-11.0.1.jar
MD5: b85ce0631dae83fe643fbd32ccd08e4c
SHA1: f1354a284f4151d20358e776f6ff68ee35bbb96d
SHA256:c5084a74417a89c69a0c122fae96a4b70bf619fc3d6218ea102a4047ec85ad04
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile
javafx-base-11.0.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-role-ui-javafx@1.1-ALPHA-3

Identifiers

javafx-controls-11.0.1-mac.jar

File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/openjfx/javafx-controls/11.0.1/javafx-controls-11.0.1-mac.jar
MD5: f321c782b9bf158a630cb0a7bea73644
SHA1: 0538fd08a4ecd76788766a69c19e90b4cc0179f8
SHA256:148468742e957b765d5ac6d5ba66ce983e1acdf582c191bb35dbfe8cdefdb314
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile
javafx-controls-11.0.1-mac.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.openjfx/javafx-controls@11.0.1

Identifiers

javafx-controls-11.0.1.jar

File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/openjfx/javafx-controls/11.0.1/javafx-controls-11.0.1.jar
MD5: 2e18fc95e4aa7ce325cefa67b9f61f3d
SHA1: 61cf91bf3494d0616216f49c9e1d183d170adf0a
SHA256:71be28dc4d80744ba541fc50d933729e8703fe1e642ae92037f6fccc7f961971
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile
javafx-controls-11.0.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-role-ui-javafx@1.1-ALPHA-3

Identifiers

javafx-fxml-11.0.1-mac.jar

File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/openjfx/javafx-fxml/11.0.1/javafx-fxml-11.0.1-mac.jar
MD5: a835057792b4fc1aa7d6c4bea9547add
SHA1: 352a51a0f0cb13cf83a081b5dd5526acd4fbab30
SHA256:56f9a32b3a1fc76c761bd40c16917ed1675c8d5dcbe492a44ce9ee2391e27139
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile
javafx-fxml-11.0.1-mac.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.openjfx/javafx-fxml@11.0.1

Identifiers

javafx-fxml-11.0.1.jar

File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/openjfx/javafx-fxml/11.0.1/javafx-fxml-11.0.1.jar
MD5: 6e4c64769d877a47edbdd0023d89a074
SHA1: f290c13d7e984d880c9f114f38c2da949ef18d54
SHA256:546fc449f01cd0bbe51a921f9d3f0e5d8764764480caca4a709e681e7ad0b6cf
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile
javafx-fxml-11.0.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-role-ui-javafx@1.1-ALPHA-3

Identifiers

javafx-graphics-11.0.1-mac.jar

File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/openjfx/javafx-graphics/11.0.1/javafx-graphics-11.0.1-mac.jar
MD5: 64a05ff45e2ff0e9695817816284daf5
SHA1: 3c5014c500e6d308eca4ac9f952d4f7e7e8dfc7e
SHA256:e0bcd295cae13c636f92911474acbab6bee836e6950d1696a02d79a041d61df2
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile
javafx-graphics-11.0.1-mac.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.openjfx/javafx-controls@11.0.1

Identifiers

javafx-graphics-11.0.1-mac.jar: javafx-swt.jar

File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/openjfx/javafx-graphics/11.0.1/javafx-graphics-11.0.1-mac.jar/javafx-swt.jar
MD5: ee1545edcd485b34080e9389f2f86b5e
SHA1: c12e9a9d5ad723c3e2b60651659b0290d68d9e48
SHA256:a7432e9a357e03571ded2ef3d148086b92c297605797bcb31d37eb95b4779317
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile

Identifiers

  • None

javafx-graphics-11.0.1.jar

File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/openjfx/javafx-graphics/11.0.1/javafx-graphics-11.0.1.jar
MD5: ff0579b2b89bfc26f6eb73f812076a1b
SHA1: e062cb01783effc6413abbd94d1838f6b0add209
SHA256:f597c672a4337a75ba856f38cf548c524b039f452423c34b55653e56c306733d
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile
javafx-graphics-11.0.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.openjfx/javafx-controls@11.0.1

Identifiers

javax.annotation-api-1.3.2.jar

Description:

Common Annotations for the JavaTM Platform API

License:

CDDL + GPLv2 with classpath exception: https://github.com/javaee/javax.annotation/blob/master/LICENSE
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/javax/annotation/javax.annotation-api/1.3.2/javax.annotation-api-1.3.2.jar
MD5: 2ab1973eefffaa2aeec47d50b9e40b9d
SHA1: 934c04d3cfef185a8008e7bf34331b79730a9d43
SHA256:e04ba5195bcd555dc95650f7cc614d151e4bcd52d29a10b8aa2197f3ab89ab9b
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile
javax.annotation-api-1.3.2.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-util@3.2-ALPHA-23

Identifiers

javax.inject-1.jar

Description:

The javax.inject API

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/javax/inject/javax.inject/1/javax.inject-1.jar
MD5: 289075e48b909e9e74e6c915b3631d2e
SHA1: 6975da39a7040257bd51d21a231b76c915872d38
SHA256:91c77044a50c481636c32d916fd89c9118a72195390452c81065080f957de7ff
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile
javax.inject-1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-role-ui-javafx@1.1-ALPHA-3

Identifiers

jsr305-3.0.2.jar

Description:

JSR305 Annotations for Findbugs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar
MD5: dd83accb899363c32b07d7a1b2e4ce40
SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d
SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile
jsr305-3.0.2.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-util@3.2-ALPHA-23

Identifiers

lombok-1.18.24.jar

Description:

Spice up your java: Automatic Resource Management, automatic generation of getters, setters, equals, hashCode and toString, and more!

License:

The MIT License: https://projectlombok.org/LICENSE
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/projectlombok/lombok/1.18.24/lombok-1.18.24.jar
MD5: a1651eaa9c999c61131d32feab16fcde
SHA1: 13a394eed5c4f9efb2a6d956e2086f1d81e857d9
SHA256:d3584bc2db03f059f984fb0a9c119aac1fa0da578a448e69fc3f68b36584c749
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:provided
lombok-1.18.24.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.steelblue/it-tidalwave-role-ui-javafx@1.1-ALPHA-3

Identifiers

lombok-1.18.24.jar: mavenEcjBootstrapAgent.jar

File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/projectlombok/lombok/1.18.24/lombok-1.18.24.jar/lombok/launch/mavenEcjBootstrapAgent.jar
MD5: 7196a24381121bf3a7c93dcdd5575fff
SHA1: 3cfed1579d718ac3dcf78bceba9ed668eb025bee
SHA256:d034830e1d8615a9d0e4afdaee693687c6e61e041cc905608bba60efb04744d6
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:provided

Identifiers

  • None

slf4j-api-2.0.7.jar

Description:

The slf4j API

License:

http://www.opensource.org/licenses/mit-license.php
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/slf4j/slf4j-api/2.0.7/slf4j-api-2.0.7.jar
MD5: 403dffa46cdd2e3c82da19df4f394a4c
SHA1: 41eb7184ea9d556f23e18b5cb99cad1f8581fc00
SHA256:5d6298b93a1905c32cda6478808ac14c2d4a47e91535e53c41f7feeb85d946f4
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile
slf4j-api-2.0.7.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-util@3.2-ALPHA-23

Identifiers

spotbugs-annotations-3.1.9.jar

Description:

Annotations the SpotBugs tool supports

License:

GNU LESSER GENERAL PUBLIC LICENSE, Version 2.1: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/com/github/spotbugs/spotbugs-annotations/3.1.9/spotbugs-annotations-3.1.9.jar
MD5: 56a1a81d69b6a111161bbce0e6dea26a
SHA1: 2ef5127efcc1a899aab8c66d449a631c9a99c469
SHA256:68c7c46b4299e94837e236ae742f399901a950fe910fe3ca710026753b5dd2e1
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile
spotbugs-annotations-3.1.9.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/it.tidalwave.thesefoolishthings/it-tidalwave-util@3.2-ALPHA-23

Identifiers

spring-core-4.3.30.RELEASE.jar

Description:

Spring Core

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/springframework/spring-core/4.3.30.RELEASE/spring-core-4.3.30.RELEASE.jar
MD5: e34fafcb6ea7a2c9db80a686af31a27e
SHA1: b255bb7389e582d24574f75bc0c880ffb8103dfa
SHA256:94a64b38e9dfa22df3c67664aea08aed559110bed386a736cb02a01d0254b236
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile
spring-core-4.3.30.RELEASE.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework/spring-context@4.3.30.RELEASE

Identifiers

CVE-2022-22965  

CISA Known Exploited Vulnerability:
  • Product: VMware Spring Framework
  • Name: Spring Framework JDK 9+ Remote Code Execution Vulnerability
  • Date Added: 2022-04-04
  • Description: Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
  • Required Action: Apply updates per vendor instructions.
  • Due Date: 2022-04-25
  • Notes: https://nvd.nist.gov/vuln/detail/CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22950  

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: MEDIUM (4.0)
  • Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2023-20861  

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
NVD-CWE-noinfo

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22968  

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
CWE-178 Improper Handling of Case Sensitivity

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22970  

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: LOW (3.5)
  • Vector: /AV:N/AC:M/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

spring-expression-4.3.30.RELEASE.jar

Description:

Spring Expression Language (SpEL)

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /Volumes/Users/fritz/Business/Tidalwave/Projects/WorkAreas/Tidalwave/tidalwave.bitbucket.io/repository/org/springframework/spring-expression/4.3.30.RELEASE/spring-expression-4.3.30.RELEASE.jar
MD5: e9959f3eadbef7006c2721f27b324627
SHA1: 6ce0709c6899dde41a7213ccccfe2535e34c80fe
SHA256:21f6d95c15e1b93675b958c69cd9309754c6909dd25c01f120a3934de7e37749
Referenced In Project/Scope: SteelBlue - JavaFX Bindings:compile
spring-expression-4.3.30.RELEASE.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework/spring-context@4.3.30.RELEASE

Identifiers

CVE-2022-22965  

CISA Known Exploited Vulnerability:
  • Product: VMware Spring Framework
  • Name: Spring Framework JDK 9+ Remote Code Execution Vulnerability
  • Date Added: 2022-04-04
  • Description: Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
  • Required Action: Apply updates per vendor instructions.
  • Due Date: 2022-04-25
  • Notes: https://nvd.nist.gov/vuln/detail/CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22950  

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: MEDIUM (4.0)
  • Vector: /AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2023-20861  

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
NVD-CWE-noinfo

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2023-20863 (OSSINDEX)  

In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
CWE-400 Uncontrolled Resource Consumption

CVSSv2:
  • Base Score: MEDIUM (6.5)
  • Vector: /AV:N/AC:L/Au:/C:N/I:N/A:H

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:org.springframework:spring-expression:4.3.30.RELEASE:*:*:*:*:*:*:*

CVE-2022-22968  

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
CWE-178 Improper Handling of Case Sensitivity

CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2022-22970  

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: LOW (3.5)
  • Vector: /AV:N/AC:M/Au:S/C:N/I:N/A:P
CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Vulnerable Software & Versions: (show all)

CVE-2024-38808 (OSSINDEX)  

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.

Specifically, an application is vulnerable when the following is true:

  *  The application evaluates user-supplied SpEL expressions.

Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2024-38808 for details
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv2:
  • Base Score: MEDIUM (5.3)
  • Vector: /AV:N/AC:L/Au:/C:/I:/A:

References:

Vulnerable Software & Versions (OSSINDEX):

  • cpe:2.3:a:org.springframework:spring-expression:4.3.30.RELEASE:*:*:*:*:*:*:*



This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the CISA Known Exploited Vulnerability Catalog.
This report may contain data retrieved from the Github Advisory Database (via NPM Audit API).
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype OSS Index.