Skip to content

esapi-2.3.0.0.jar: 20 vulnerabilities (highest severity is: 9.8) reachable #16

Open
Open
esapi-2.3.0.0.jar: 20 vulnerabilities (highest severity is: 9.8) reachable#16
Labels
Mend: dependency security vulnerabilitySecurity vulnerability detected by WhiteSource

Description

@staging-whitesource-for-github-com
staging-whitesource-for-github-com
bot
opened on Mar 2, 2026
Vulnerable Library - esapi-2.3.0.0.jar

The Enterprise Security API (ESAPI) project is an OWASP project to create simple strong security controls for every web platform. Security controls are not simple to build. You can read about the hundreds of pitfalls for unwary developers on the OWASP web site. By providing developers with a set of strong controls, we aim to eliminate some of the complexity of creating secure web applications. This can result in significant cost savings across the SDLC.

Library home page: https://owasp.org/www-project-enterprise-security-api/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.3.0.0/esapi-2.3.0.0.jar

Vulnerabilities

Vulnerability Severity CVSS Dependency Type Fixed in (esapi version) Remediation Possible** Reachability
CVE-2022-23305 Critical 9.8 log4j-1.2.17.jar Transitive N/A* ❌

Reachable
CVE-2022-23302 High 8.8 log4j-1.2.17.jar Transitive N/A* ❌

Reachable
WS-2014-0034 High 7.5 commons-fileupload-1.3.3.jar Transitive N/A* ❌

Reachable
CVE-2021-4104 High 7.5 log4j-1.2.17.jar Transitive N/A* ❌

Reachable
CVE-2021-29425 Medium 4.8 commons-io-2.6.jar Transitive 2.5.3.0 ✅

Reachable
CVE-2020-9488 Low 3.7 log4j-1.2.17.jar Transitive N/A* ❌

Reachable
CVE-2020-9493 Critical 9.8 log4j-1.2.17.jar Transitive N/A* ❌

Unreachable
CVE-2019-17571 Critical 9.8 log4j-1.2.17.jar Transitive N/A* ❌

Unreachable
CVE-2022-23307 High 8.8 log4j-1.2.17.jar Transitive N/A* ❌

Unreachable
CVE-2024-47554 Medium 4.3 commons-io-2.6.jar Transitive 2.7.0.0 ✅

Unreachable
CVE-2025-041125 Critical 9.8 log4j-1.2.17.jar Transitive N/A* ❌
CVE-2025-48976 High 7.5 commons-fileupload-1.3.3.jar Transitive 2.7.0.0 ✅
CVE-2023-26464 High 7.5 log4j-1.2.17.jar Transitive N/A* ❌
CVE-2023-24998 High 7.5 commons-fileupload-1.3.3.jar Transitive 2.5.2.0 ✅
CVE-2022-29546 High 7.5 neko-htmlunit-2.24.jar Transitive 2.4.0.0 ✅
CVE-2022-28366 High 7.5 neko-htmlunit-2.24.jar Transitive 2.4.0.0 ✅
CVE-2025-5878 High 7.3 esapi-2.3.0.0.jar Direct 2.7.0.0 ✅
CVE-2025-46392 Medium 6.5 commons-configuration-1.10.jar Transitive N/A* ❌
CVE-2024-23635 Medium 6.1 antisamy-1.6.7.jar Transitive 2.5.4.0 ✅
CVE-2023-43643 Medium 6.1 antisamy-1.6.7.jar Transitive 2.5.3.0 ✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-23305

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Library home page: http://www.apache.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ log4j-1.2.17.jar (Vulnerable Library)

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DatabaseHelper (Application)
  -> org.owasp.esapi.ESAPI (Extension)
   -> org.owasp.esapi.logging.log4j.Log4JLogFactory (Extension)
    -> org.apache.log4j.Logger (Extension)
     -> ❌ org.apache.log4j.DailyRollingFileAppender (Vulnerable Component)

Vulnerability Details

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Publish Date: 2022-01-18

URL: CVE-2022-23305

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://reload4j.qos.ch/

Release Date: 2022-01-18

Fix Resolution: ch.qos.reload4j:reload4j:1.2.18.2

CVE-2022-23302

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Library home page: http://www.apache.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ log4j-1.2.17.jar (Vulnerable Library)

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DatabaseHelper (Application)
  -> org.owasp.esapi.ESAPI (Extension)
   -> org.owasp.esapi.logging.log4j.Log4JLogFactory (Extension)
    -> org.apache.log4j.Logger (Extension)
     -> ❌ org.apache.log4j.DailyRollingFileAppender (Vulnerable Component)

Vulnerability Details

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Publish Date: 2022-01-18

URL: CVE-2022-23302

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://reload4j.qos.ch/

Release Date: 2022-01-18

Fix Resolution: ch.qos.reload4j:reload4j:1.2.18.1

WS-2014-0034

Vulnerable Library - commons-fileupload-1.3.3.jar

The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.

Library home page: https://www.apache.org/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-fileupload/commons-fileupload/1.3.3/commons-fileupload-1.3.3.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ commons-fileupload-1.3.3.jar (Vulnerable Library)

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DatabaseHelper (Application)
  -> org.owasp.esapi.ESAPI (Extension)
   -> org.owasp.esapi.reference.DefaultHTTPUtilities (Extension)
    -> org.apache.commons.fileupload.servlet.ServletFileUpload (Extension)
     -> ❌ org.apache.commons.fileupload.FileUploadBase (Vulnerable Component)

Vulnerability Details

The class FileUploadBase in Apache Commons Fileupload before 1.4 has potential resource leak - InputStream not closed on exception.

Publish Date: 2026-05-19

URL: WS-2014-0034

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2014-02-17

Fix Resolution: commons-fileupload:commons-fileupload:1.4

CVE-2021-4104

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Library home page: http://www.apache.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ log4j-1.2.17.jar (Vulnerable Library)

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DatabaseHelper (Application)
  -> org.owasp.esapi.ESAPI (Extension)
   -> org.owasp.esapi.logging.log4j.Log4JLogFactory (Extension)
    -> org.apache.log4j.Logger (Extension)
     -> ❌ org.apache.log4j.net.JMSAppender (Vulnerable Component)

Vulnerability Details

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Publish Date: 2021-12-14

URL: CVE-2021-4104

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-4104

Release Date: 2021-12-14

Fix Resolution: uom-parent - 1.0.3-3.module,1.0.3-3.module;uom-se-javadoc - 1.0.4-3.module;parfait-examples - 0.5.4-4.module;log4j-manual - 1.2.17-16;si-units-javadoc - 0.6.5-2.module;unit-api - 1.0-5.module,1.0-5.module;unit-api-javadoc - 1.0-5.module;parfait - 0.5.4-4.module,0.5.4-4.module;log4j-javadoc - 1.2.17-16;uom-systems-javadoc - 0.7-1.module;uom-lib-javadoc - 1.0.1-6.module;uom-systems - 0.7-1.module,0.7-1.module;log4j - 1.2.17-16,1.2.17-16;uom-se - 1.0.4-3.module,1.0.4-3.module;uom-lib - 1.0.1-6.module,1.0.1-6.module;parfait-javadoc - 0.5.4-4.module;pcp-parfait-agent - 0.5.4-4.module;si-units - 0.6.5-2.module,0.6.5-2.module

CVE-2021-29425

Vulnerable Library - commons-io-2.6.jar

The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.

Library home page: https://www.apache.org/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-io/commons-io/2.6/commons-io-2.6.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ commons-io-2.6.jar (Vulnerable Library)

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DatabaseHelper (Application)
  -> org.owasp.esapi.ESAPI (Extension)
   -> org.owasp.esapi.reference.DefaultHTTPUtilities (Extension)
    -> org.apache.commons.fileupload.disk.DiskFileItemFactory (Extension)
    ...
      -> org.apache.commons.io.output.DeferredFileOutputStream (Extension)
       -> org.apache.commons.io.FileUtils (Extension)
        -> ❌ org.apache.commons.io.FilenameUtils (Vulnerable Component)

Vulnerability Details

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2021-04-13

URL: CVE-2021-29425

CVSS 3 Score Details (4.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29425

Release Date: 2021-04-13

Fix Resolution (commons-io:commons-io): 2.7

Direct dependency fix Resolution (org.owasp.esapi:esapi): 2.5.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-9488

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Library home page: http://www.apache.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ log4j-1.2.17.jar (Vulnerable Library)

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DatabaseHelper (Application)
  -> org.owasp.esapi.ESAPI (Extension)
   -> org.owasp.esapi.logging.log4j.Log4JLogger (Extension)
    -> org.apache.log4j.Logger (Extension)
     -> ❌ org.apache.log4j.net.SMTPAppender (Vulnerable Component)

Vulnerability Details

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

Publish Date: 2020-04-27

URL: CVE-2020-9488

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://reload4j.qos.ch/

Release Date: 2020-04-27

Fix Resolution: ch.qos.reload4j:reload4j:1.2.18.3,org.apache.logging.log4j:log4j-core - 2.13.2,org.apache.logging.log4j:log4j-core - 2.12.3,org.apache.logging.log4j:log4j-core - 2.3.2

CVE-2020-9493

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Library home page: http://www.apache.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ log4j-1.2.17.jar (Vulnerable Library)

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.

Publish Date: 2021-06-16

URL: CVE-2020-9493

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.openwall.com/lists/oss-security/2021/06/16/1

Release Date: 2021-06-16

Fix Resolution: ch.qos.reload4j:reload4j:1.2.18.1

CVE-2019-17571

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Library home page: http://www.apache.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ log4j-1.2.17.jar (Vulnerable Library)

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Publish Date: 2019-12-20

URL: CVE-2019-17571

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E

Release Date: 2019-12-20

Fix Resolution: log4j-manual - 1.2.17-16;log4j-javadoc - 1.2.17-16;log4j - 1.2.17-16,1.2.17-16

CVE-2022-23307

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Library home page: http://www.apache.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ log4j-1.2.17.jar (Vulnerable Library)

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Publish Date: 2022-01-18

URL: CVE-2022-23307

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-01-18

Fix Resolution: ch.qos.reload4j:reload4j:1.2.18.1

CVE-2024-47554

Vulnerable Library - commons-io-2.6.jar

The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.

Library home page: https://www.apache.org/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-io/commons-io/2.6/commons-io-2.6.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ commons-io-2.6.jar (Vulnerable Library)

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Uncontrolled Resource Consumption vulnerability in Apache Commons IO.
The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.
This issue affects Apache Commons IO: from 2.0 before 2.14.0.
Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2024-10-03

URL: CVE-2024-47554

CVSS 3 Score Details (4.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1

Release Date: 2024-10-03

Fix Resolution (commons-io:commons-io): 2.14.0

Direct dependency fix Resolution (org.owasp.esapi:esapi): 2.7.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2025-041125

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Library home page: http://www.apache.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ log4j-1.2.17.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

test log4j

Publish Date: 2025-11-03

URL: CVE-2025-041125

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2025-48976

Vulnerable Library - commons-fileupload-1.3.3.jar

The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.

Library home page: https://www.apache.org/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-fileupload/commons-fileupload/1.3.3/commons-fileupload-1.3.3.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ commons-fileupload-1.3.3.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.
This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.
Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-06-16

URL: CVE-2025-48976

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-vv7r-c36w-3prj

Release Date: 2025-06-16

Fix Resolution (commons-fileupload:commons-fileupload): 1.6.0

Direct dependency fix Resolution (org.owasp.esapi:esapi): 2.7.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-26464

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Library home page: http://www.apache.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ log4j-1.2.17.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

** UNSUPPORTED WHEN ASSIGNED **
When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested)
hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized.
This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Publish Date: 2023-03-10

URL: CVE-2023-26464

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-vp98-w2p3-mv35

Release Date: 2023-03-10

Fix Resolution: org.apache.logging.log4j:log4j-core - 2.0

CVE-2023-24998

Vulnerable Library - commons-fileupload-1.3.3.jar

The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.

Library home page: https://www.apache.org/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-fileupload/commons-fileupload/1.3.3/commons-fileupload-1.3.3.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ commons-fileupload-1.3.3.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.

Note that, like all of the file upload limits, the
new configuration option (FileUploadBase#setFileCountMax) is not
enabled by default and must be explicitly configured.

Publish Date: 2023-02-20

URL: CVE-2023-24998

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://tomcat.apache.org/security-10.html

Release Date: 2023-02-20

Fix Resolution (commons-fileupload:commons-fileupload): 1.5

Direct dependency fix Resolution (org.owasp.esapi:esapi): 2.5.2.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-29546

Vulnerable Library - neko-htmlunit-2.24.jar

HtmlUnit adaptation of NekoHtml. It has the same functionality but exposing HTMLElements to be overridden.

Library home page: http://htmlunit.sourceforge.net

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/net/sourceforge/htmlunit/neko-htmlunit/2.24/neko-htmlunit-2.24.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ neko-htmlunit-2.24.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.

Publish Date: 2022-04-25

URL: CVE-2022-29546

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-04-25

Fix Resolution (net.sourceforge.htmlunit:neko-htmlunit): 2.61.0

Direct dependency fix Resolution (org.owasp.esapi:esapi): 2.4.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-28366

Vulnerable Library - neko-htmlunit-2.24.jar

HtmlUnit adaptation of NekoHtml. It has the same functionality but exposing HTMLElements to be overridden.

Library home page: http://htmlunit.sourceforge.net

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/net/sourceforge/htmlunit/neko-htmlunit/2.24/neko-htmlunit-2.24.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ neko-htmlunit-2.24.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24839.

Publish Date: 2022-04-21

URL: CVE-2022-28366

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-g9hh-vvx3-v37v

Release Date: 2022-04-21

Fix Resolution (net.sourceforge.htmlunit:neko-htmlunit): 2.27

Direct dependency fix Resolution (org.owasp.esapi:esapi): 2.4.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2025-5878

Vulnerable Library - esapi-2.3.0.0.jar

The Enterprise Security API (ESAPI) project is an OWASP project to create simple strong security controls for every web platform. Security controls are not simple to build. You can read about the hundreds of pitfalls for unwary developers on the OWASP web site. By providing developers with a set of strong controls, we aim to eliminate some of the complexity of creating secure web applications. This can result in significant cost savings across the SDLC.

Library home page: https://owasp.org/www-project-enterprise-security-api/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.3.0.0/esapi-2.3.0.0.jar

Dependency Hierarchy:

  • ❌ esapi-2.3.0.0.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public. The project was contacted early about this issue and handled it with an exceptional level of professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID f75ac2c2647a81d2cfbdc9c899f8719c240ed512 is disabling the feature by default and any attempt to use it will trigger a warning. And commit ID e2322914304d9b1c52523ff24be495b7832f6a56 is updating the misleading Java class documentation to warn about the risks.

Publish Date: 2025-06-29

URL: CVE-2025-5878

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hxjw-v2v5-hpcr

Release Date: 2025-06-29

Fix Resolution: 2.7.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2025-46392

Vulnerable Library - commons-configuration-1.10.jar

Tools to assist in the reading of configuration/preferences files in various formats.

Library home page: http://www.apache.org/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-configuration/commons-configuration/1.10/commons-configuration-1.10.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ commons-configuration-1.10.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x.
There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations.
Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.

Publish Date: 2025-05-09

URL: CVE-2025-46392

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2024-23635

Vulnerable Library - antisamy-1.6.7.jar

A library for performing fast, configurable cleansing of HTML coming from untrusted sources.

Library home page: https://github.com/nahsra/antisamy

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/owasp/antisamy/antisamy/1.6.7/antisamy-1.6.7.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ antisamy-1.6.7.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the preserveComments directive must be enabled in your policy file. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. Patched in AntiSamy 1.7.5 and later.

Publish Date: 2024-02-02

URL: CVE-2024-23635

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2mrq-w8pv-5pvq

Release Date: 2024-02-02

Fix Resolution (org.owasp.antisamy:antisamy): 1.7.5

Direct dependency fix Resolution (org.owasp.esapi:esapi): 2.5.4.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-43643

Vulnerable Library - antisamy-1.6.7.jar

A library for performing fast, configurable cleansing of HTML coming from untrusted sources.

Library home page: https://github.com/nahsra/antisamy

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/owasp/antisamy/antisamy/1.6.7/antisamy-1.6.7.jar

Dependency Hierarchy:

  • esapi-2.3.0.0.jar (Root Library)
    • ❌ antisamy-1.6.7.jar (Vulnerable Library)

Found in base branch: master

Vulnerability Details

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the preserveComments directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. This issue has been patched in AntiSamy 1.7.4 and later.

Publish Date: 2023-10-09

URL: CVE-2023-43643

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-43643

Release Date: 2023-10-09

Fix Resolution (org.owasp.antisamy:antisamy): 1.7.4

Direct dependency fix Resolution (org.owasp.esapi:esapi): 2.5.3.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Mend: dependency security vulnerabilitySecurity vulnerability detected by WhiteSource

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions