Coder Social home page Coder Social logo

readyapi-testengine-maven-plugin's Introduction

ReadyAPI TestEngine Maven Plugin

A maven plugin that runs a set of SoapUI/ReadyAPI projects with ReadyAPI TestEngine - configure it to run in whatever build phase you might find relevant, for example;

<plugin>
    <groupId>com.smartbear.readyapi</groupId>
    <artifactId>testengine-maven-plugin</artifactId>
    <version>1.0.1</version>
    <configuration>
        <username>defaultUser</username>
        <password>defaultPassword</password>
        <server>...ReadyAPI TestEngine endpoint...</server>
    </configuration>
    <executions>
        <execution>
            <id>run</id>
            <phase>integration-test</phase>
            <goals>
                <goal>run</goal>
            </goals>
        </execution>
    </executions>
</plugin>

The only goal exposed by the plugin is "run" - you can invoke it as above or directly from the command-line, for example

mvn testengine:run 

The plugin will look for files with either json or xml extensions.

Configuration

Configuration parameters are:

  • username (required) : the TestEngine username to use for authentication
  • password (required) : the TestEngine password to use for authentication
  • server (required) : endpoint of the TestEngine (no trailing slash!)
  • projectsDirectory : the folder to scan recursively for projects and recipes, defaults to ${project.basedir}/src/test/resources/test-projects
  • targetDirectory : the folder to which filtered recipes will be copied before executing, defaults to ${project.basedir}/target/test-recipes
  • properties : an optional set of additional properties that will be used during filtering (see below)
  • disableFiltering : disables filtering of recipes - if set to true the recipes will not be copied and filtered to the target directory, instead they will run directly from the source directory.
  • reportTarget : the folder to which a junit-report.xml file will be generated (as can be processed by the surefire plugin), defaults to ${basedir}/target/surefire-reports
  • environment : if you're submitting existing SoapUI/Ready!API project files this allows you to select which environment to target
  • async : toggle if tests should be executed asynchronously - default is false which will wait for tests to finish to be able to create test-reports. Setting this to true will disable reporting functionality, but allow you to specify an optional callback that will be called by the TestEngine with test results when they are finished.
  • callback : an optional url to call with finished test results if async is set to true
  • hostAndPort: an optional string in the format host:port which will replace the host and port in all HTTP requests sent by the test.

Specifying a skipApiTests system property will bypass this plugin altogether.

The plugin will also look for standard properties file named testengine.properties in the projectsDirectory folder and load any properties in this file before applying the properties specified in the configuration.

Filtering

Json recipes will be filtered and copied to the folder specified by targetDirectory before getting executed. Any available property will be replaced, which makes it easy to parameterize your tests.

For example the following simple recipe:

{
    "testSteps": [
        {
            "type": "REST Request",
            "method": "GET",
            "URI": "${apitest.host}/apis",
            "assertions": [
                {
                    "type": "Valid HTTP Status Codes",
                    "validStatusCodes": [200]
                }
            ]
        }
    ]
}

would use a property defined as

...
<apitest.host>...</apitest.host>
...

when assembling the URI. You can simply look in the targetDirectory folder after your tests were run to see what was actually executed.

Error reporting

Currently the plugin simple fails the build if any tests fail and dumps the ReadyAPI TestEngine response to the console. A surefire xml file is generated for inclusion in generated reports.

Building the plugin

Simply pull this repo and run

mvn clean install

to install the latest version of the plugin locally. It will eventually be made available on maven central also.

Next steps?

Obviously huge list of things to improve:

  • support datadriven tests
  • improved surefire reports
  • etc..

readyapi-testengine-maven-plugin's People

Contributors

dependabot[bot] avatar jakubpkochanski avatar joeljons avatar martinloewinger avatar mend-for-github-com[bot] avatar olensmar avatar sverdlovka avatar

Stargazers

 avatar

Watchers

 avatar  avatar  avatar  avatar

readyapi-testengine-maven-plugin's Issues

CVE-2019-16942 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2019-16942 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

Publish Date: 2019-10-01

URL: CVE-2019-16942

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16942

Release Date: 2019-10-01

Fix Resolution: 2.9.10.1

CVE-2019-16943 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2019-16943 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.

Publish Date: 2019-10-01

URL: CVE-2019-16943

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16943

Release Date: 2019-10-01

Fix Resolution: 2.9.10.1

CVE-2020-36186 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-36186 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.

Publish Date: 2021-01-06

URL: CVE-2020-36186

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-06

Fix Resolution: 2.9.10.8

CVE-2020-36189 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-36189 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.

Publish Date: 2021-01-06

URL: CVE-2020-36189

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-06

Fix Resolution: 2.9.10.8

CVE-2020-14061 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-14061 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).

Publish Date: 2020-06-14

URL: CVE-2020-14061

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14061

Release Date: 2020-06-14

Fix Resolution: 2.9.10.5

CVE-2020-10672 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-10672 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

Publish Date: 2020-03-18

URL: CVE-2020-10672

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-10672

Release Date: 2020-03-18

Fix Resolution: 2.9.10.4

CVE-2019-20330 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2019-20330 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

Publish Date: 2020-01-03

URL: CVE-2019-20330

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-01-03

Fix Resolution: 2.9.10.2

CVE-2020-9548 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-9548 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

Publish Date: 2020-03-02

URL: CVE-2020-9548

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9548

Release Date: 2020-03-02

Fix Resolution: 2.9.10.4

CVE-2019-14540 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2019-14540 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

Publish Date: 2019-09-15

URL: CVE-2019-14540

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14540

Release Date: 2019-09-15

Fix Resolution: 2.9.10.2

CVE-2016-1000027 (High) detected in spring-web-4.1.9.RELEASE.jar - autoclosed

CVE-2016-1000027 - High Severity Vulnerability

Vulnerable Library - spring-web-4.1.9.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /canner/.m2/repository/org/springframework/spring-web/4.1.9.RELEASE/spring-web-4.1.9.RELEASE.jar

Dependency Hierarchy:

  • โŒ spring-web-4.1.9.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.

Publish Date: 2020-01-02

URL: CVE-2016-1000027

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-1000027

Release Date: 2020-01-02

Fix Resolution: 4.3.26.RELEASE


  • Check this box to open an automated fix PR

CVE-2020-14060 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-14060 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).

Publish Date: 2020-06-14

URL: CVE-2020-14060

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14060

Release Date: 2020-06-14

Fix Resolution: 2.9.10.5

CVE-2020-36182 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-36182 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.

Publish Date: 2021-01-07

URL: CVE-2020-36182

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-07

Fix Resolution: 2.9.10.8

CVE-2020-14062 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-14062 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).

Publish Date: 2020-06-14

URL: CVE-2020-14062

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14062

Release Date: 2020-06-14

Fix Resolution: 2.9.10.5

CVE-2020-9547 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-9547 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

Publish Date: 2020-03-02

URL: CVE-2020-9547

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9547

Release Date: 2020-03-02

Fix Resolution: 2.9.10.4

CVE-2019-17531 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2019-17531 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.

Publish Date: 2019-10-12

URL: CVE-2019-17531

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17531

Release Date: 2019-10-12

Fix Resolution: 2.9.10.1

CVE-2020-11111 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-11111 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).

Publish Date: 2020-03-31

URL: CVE-2020-11111

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11113

Release Date: 2020-03-31

Fix Resolution: 2.9.10.4

CVE-2018-1272 (High) detected in spring-web-4.1.9.RELEASE.jar - autoclosed

CVE-2018-1272 - High Severity Vulnerability

Vulnerable Library - spring-web-4.1.9.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: /pom.xml

Path to vulnerable library: /canner/.m2/repository/org/springframework/spring-web/4.1.9.RELEASE/spring-web-4.1.9.RELEASE.jar

Dependency Hierarchy:

  • โŒ spring-web-4.1.9.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.

Publish Date: 2018-04-06

URL: CVE-2018-1272

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://tanzu.vmware.com/security/cve-2018-1272

Release Date: 2018-04-06

Fix Resolution: 4.2.0.RELEASE


  • Check this box to open an automated fix PR

CVE-2020-10968 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-10968 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).

Publish Date: 2020-03-26

URL: CVE-2020-10968

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-10968

Release Date: 2020-03-26

Fix Resolution: 2.9.10.4

CVE-2020-11620 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-11620 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).

Publish Date: 2020-04-07

URL: CVE-2020-11620

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11620

Release Date: 2020-04-07

Fix Resolution: 2.9.10.4

CVE-2020-36187 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-36187 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.

Publish Date: 2021-01-06

URL: CVE-2020-36187

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-06

Fix Resolution: 2.9.10.8

CVE-2020-36188 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-36188 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.

Publish Date: 2021-01-06

URL: CVE-2020-36188

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-06

Fix Resolution: 2.9.10.8

CVE-2020-25649 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-25649 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Publish Date: 2020-12-03

URL: CVE-2020-25649

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-12-03

Fix Resolution: 2.9.10.7

CVE-2020-35490 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-35490 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.

Publish Date: 2020-12-17

URL: CVE-2020-35490

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-12-17

Fix Resolution: 2.9.10.5

CVE-2020-35728 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-35728 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

Publish Date: 2020-12-27

URL: CVE-2020-35728

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35728

Release Date: 2020-12-27

Fix Resolution: 2.9.10.8

CVE-2020-36185 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-36185 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.

Publish Date: 2021-01-06

URL: CVE-2020-36185

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-06

Fix Resolution: 2.9.10.8

CVE-2020-36179 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-36179 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

Publish Date: 2021-01-07

URL: CVE-2020-36179

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-07

Fix Resolution: 2.9.10.8

CVE-2020-24616 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-24616 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

Publish Date: 2020-08-25

URL: CVE-2020-24616

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24616

Release Date: 2020-08-25

Fix Resolution: 2.9.10.5

CVE-2020-8908 (Low) detected in guava-28.1-jre.jar - autoclosed - autoclosed - autoclosed - autoclosed

CVE-2020-8908 - Low Severity Vulnerability

Vulnerable Library - guava-28.1-jre.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Library home page: https://github.com/google/guava

Path to dependency file: readyapi-testengine-maven-plugin/pom.xml

Path to vulnerable library: canner/.m2/repository/com/google/guava/guava/28.1-jre/guava-28.1-jre.jar

Dependency Hierarchy:

  • โŒ guava-28.1-jre.jar (Vulnerable Library)

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Publish Date: 2020-12-10

URL: CVE-2020-8908

CVSS 3 Score Details (3.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8908

Release Date: 2020-12-10

Fix Resolution: v30.0


  • Check this box to open an automated fix PR

WS-2019-0379 (Medium) detected in commons-codec-1.11.jar - autoclosed - autoclosed - autoclosed - autoclosed

WS-2019-0379 - Medium Severity Vulnerability

Vulnerable Library - commons-codec-1.11.jar

The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

Path to dependency file: readyapi-testengine-maven-plugin/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar

Dependency Hierarchy:

  • httpclient-4.5.10.jar (Root Library)
    • โŒ commons-codec-1.11.jar (Vulnerable Library)

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

Apache commons-codec before version โ€œcommons-codec-1.13-RC1โ€ is vulnerable to information disclosure due to Improper Input validation.

Publish Date: 2019-05-20

URL: WS-2019-0379

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: apache/commons-codec@48b6157

Release Date: 2019-05-20

Fix Resolution: commons-codec:commons-codec:1.13

CVE-2018-1199 (Medium) detected in spring-core-4.1.9.RELEASE.jar - autoclosed - autoclosed - autoclosed - autoclosed

CVE-2018-1199 - Medium Severity Vulnerability

Vulnerable Library - spring-core-4.1.9.RELEASE.jar

Spring Core

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: readyapi-testengine-maven-plugin/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-core/4.1.9.RELEASE/spring-core-4.1.9.RELEASE.jar

Dependency Hierarchy:

  • spring-web-4.1.9.RELEASE.jar (Root Library)
    • โŒ spring-core-4.1.9.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.

Publish Date: 2018-03-16

URL: CVE-2018-1199

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-1199

Release Date: 2018-03-16

Fix Resolution: org.springframework.security:spring-security-web:4.1.5.RELEASE,4.2.4.RELEASE,5.0.1.RELEASE,5.0.3.RELEASE,org.springframework.security:spring-security-config:4.1.5.RELEASE,4.2.4.RELEASE,5.0.1.RELEASE,5.0.3.RELEASE,org.springframework:spring-core:4.1.5.RELEASE,4.2.4.RELEASE,5.0.1.RELEASE,5.0.3.RELEASE,4.3.14.RELEASE

CVE-2021-23926 (High) detected in xmlbeans-2.4.0.jar - autoclosed

CVE-2021-23926 - High Severity Vulnerability

Vulnerable Library - xmlbeans-2.4.0.jar

XmlBeans main jar

Dependency Hierarchy:

Found in base branch: master

Vulnerability Details

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Publish Date: 2021-01-14

URL: CVE-2021-23926

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23926

Release Date: 2021-01-14

Fix Resolution: 3.0.0

CVE-2020-11112 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-11112 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

Publish Date: 2020-03-31

URL: CVE-2020-11112

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11112

Release Date: 2020-03-31

Fix Resolution: 2.9.10.4

CVE-2020-5421 (Medium) detected in spring-web-4.1.9.RELEASE.jar - autoclosed - autoclosed - autoclosed - autoclosed

CVE-2020-5421 - Medium Severity Vulnerability

Vulnerable Library - spring-web-4.1.9.RELEASE.jar

Spring Web

Library home page: https://github.com/spring-projects/spring-framework

Path to dependency file: readyapi-testengine-maven-plugin/pom.xml

Path to vulnerable library: canner/.m2/repository/org/springframework/spring-web/4.1.9.RELEASE/spring-web-4.1.9.RELEASE.jar

Dependency Hierarchy:

  • โŒ spring-web-4.1.9.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

Publish Date: 2020-09-19

URL: CVE-2020-5421

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://tanzu.vmware.com/security/cve-2020-5421

Release Date: 2020-07-21

Fix Resolution: org.springframework:spring-web:5.2.9,org.springframework:spring-web:5.1.18,org.springframework:spring-web:5.0.19,org.springframework:spring-web:4.3.29


  • Check this box to open an automated fix PR

Plugin does not fail on project execution failure

When the TestJob has failed on the TestEngine, the build is still marked as successful, also in the logs:

[INFO] ReadyAPI TestEngine Maven Plugin
[INFO] --------------------------------------
[INFO] Recipes run: 0
[INFO] Projects run: 1
[INFO] Failures: 0

Probably this is because currently plugin uses old report model, see in pom.xml:

<dependency>
    <groupId>com.smartbear.readyapi</groupId>
     <artifactId>ready-api-testserver-client</artifactId>
     <version>1.0.0</version>
</dependency>

CVE-2020-14195 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-14195 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).

Publish Date: 2020-06-16

URL: CVE-2020-14195

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14195

Release Date: 2020-06-16

Fix Resolution: 2.9.10.5

CVE-2020-13956 (Medium) detected in httpclient-4.5.10.jar - autoclosed - autoclosed - autoclosed - autoclosed

CVE-2020-13956 - Medium Severity Vulnerability

Vulnerable Library - httpclient-4.5.10.jar

Apache HttpComponents Client

Path to dependency file: readyapi-testengine-maven-plugin/pom.xml

Path to vulnerable library: canner/.m2/repository/org/apache/httpcomponents/httpclient/4.5.10/httpclient-4.5.10.jar

Dependency Hierarchy:

  • โŒ httpclient-4.5.10.jar (Vulnerable Library)

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Publish Date: 2020-12-02

URL: CVE-2020-13956

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-13956

Release Date: 2020-07-21

Fix Resolution: org.apache.httpcomponents:httpclient:4.5.13;org.apache.httpcomponents:httpclient-osgi:4.5.13;org.apache.httpcomponents.client5:httpclient5:5.0.3;org.apache.httpcomponents.client5:httpclient5-osgi:5.0.3

CVE-2020-36183 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-36183 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.

Publish Date: 2021-01-07

URL: CVE-2020-36183

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-07

Fix Resolution: 2.9.10.8

CVE-2020-9546 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-9546 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

Publish Date: 2020-03-02

URL: CVE-2020-9546

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9546

Release Date: 2020-03-02

Fix Resolution: 2.9.10.4

CVE-2020-8840 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-8840 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Publish Date: 2020-02-10

URL: CVE-2020-8840

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-02-10

Fix Resolution: 2.9.10.3

CVE-2020-36180 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-36180 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.

Publish Date: 2021-01-07

URL: CVE-2020-36180

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-07

Fix Resolution: 2.9.10.8

CVE-2020-36184 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-36184 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.

Publish Date: 2021-01-06

URL: CVE-2020-36184

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-06

Fix Resolution: 2.9.10.8

CVE-2020-10673 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-10673 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

Publish Date: 2020-03-18

URL: CVE-2020-10673

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-18

Fix Resolution: 2.9.10.4

CVE-2021-20190 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2021-20190 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in base branch: master

Vulnerability Details

A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Publish Date: 2021-01-19

URL: CVE-2021-20190

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-19

Fix Resolution: 2.9.10.7

CVE-2020-24750 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-24750 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.

Publish Date: 2020-09-17

URL: CVE-2020-24750

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24616

Release Date: 2020-09-17

Fix Resolution: 2.9.10.5

CVE-2020-11113 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-11113 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

Publish Date: 2020-03-31

URL: CVE-2020-11113

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11113

Release Date: 2020-03-31

Fix Resolution: 2.9.10.4

CVE-2020-35491 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-35491 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.

Publish Date: 2020-12-17

URL: CVE-2020-35491

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-12-17

Fix Resolution: 2.9.10.5

CVE-2020-10969 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-10969 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.

Publish Date: 2020-03-26

URL: CVE-2020-10969

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10969

Release Date: 2020-03-26

Fix Resolution: 2.9.10.4

CVE-2020-11619 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-11619 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in HEAD commit: d0981d735a777d1527cbd9a85bc57b01302d04f7

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

Publish Date: 2020-04-07

URL: CVE-2020-11619

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11619

Release Date: 2020-04-07

Fix Resolution: 2.9.10.4

CVE-2020-36181 (High) detected in jackson-databind-2.9.10.jar - autoclosed

CVE-2020-36181 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.10.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Dependency Hierarchy:

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.

Publish Date: 2021-01-06

URL: CVE-2020-36181

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-06

Fix Resolution: 2.9.10.8

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.