esapi-2.3.0.0.jar: 15 vulnerabilities (highest severity is: 9.8) reachable #14

Vulnerable Library - esapi-2.3.0.0.jar

The Enterprise Security API (ESAPI) project is an OWASP project to create simple strong security controls for every web platform. Security controls are not simple to build. You can read about the hundreds of pitfalls for unwary developers on the OWASP web site. By providing developers with a set of strong controls, we aim to eliminate some of the complexity of creating secure web applications. This can result in significant cost savings across the SDLC.

Library home page: https://owasp.org/www-project-enterprise-security-api/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.3.0.0/esapi-2.3.0.0.jar

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

CVE-2025-48734

Vulnerable Library - commons-beanutils-1.9.4.jar

Apache Commons BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection.

Library home page: https://www.apache.org/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-beanutils/commons-beanutils/1.9.4/commons-beanutils-1.9.4.jar

Dependency Hierarchy:

• esapi-2.3.0.0.jar (Root Library)
  • ❌ commons-beanutils-1.9.4.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DatabaseHelper (Application)
  -> org.owasp.esapi.ESAPI (Extension)
   -> org.owasp.esapi.reference.accesscontrol.ExperimentalAccessController (Extension)
    -> org.apache.commons.configuration.DefaultConfigurationBuilder (Extension)
    ...
      -> org.apache.commons.beanutils.BeanUtils (Extension)
       -> org.apache.commons.beanutils.BeanUtilsBean (Extension)
        -> ❌ org.apache.commons.beanutils.ConvertUtilsBean (Vulnerable Component)

Vulnerability Details

Improper Access Control vulnerability in Apache Commons.
A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.
Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().
Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.
This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils
1.x are recommended to upgrade to version 1.11.0, which fixes the issue.
Users of the artifact org.apache.commons:commons-beanutils2
2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

Publish Date: 2025-05-28

URL: CVE-2025-48734

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-wxr5-93ph-8wr9

Release Date: 2025-05-28

Fix Resolution (commons-beanutils:commons-beanutils): 1.11.0

Direct dependency fix Resolution (org.owasp.esapi:esapi): 2.6.2.0

⛑️ Automatic Remediation will be attempted for this issue.

WS-2023-0388

Vulnerable Library - esapi-2.3.0.0.jar

The Enterprise Security API (ESAPI) project is an OWASP project to create simple strong security controls for every web platform. Security controls are not simple to build. You can read about the hundreds of pitfalls for unwary developers on the OWASP web site. By providing developers with a set of strong controls, we aim to eliminate some of the complexity of creating secure web applications. This can result in significant cost savings across the SDLC.

Library home page: https://owasp.org/www-project-enterprise-security-api/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.3.0.0/esapi-2.3.0.0.jar

Dependency Hierarchy:

• ❌ esapi-2.3.0.0.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DatabaseHelper (Application)
  -> org.owasp.esapi.ESAPI (Extension)
   -> ❌ org.owasp.esapi.reference.DefaultHTTPUtilities (Vulnerable Component)

Vulnerability Details

Impact ESAPI 2.5.2.0 and later addressed the DoS vulnerability described in CVE-2023-24998, which Apache Commons FileUpload 1.5 attempted to remediate. But while writing up a new security bulletin regarding the impact on the affected ESAPI "HTTPUtilities.getFileUploads" methods (or more specifically those methods in the "DefaultHTTPUtilities" implementation class), I realized that a DoS vulnerability still persists in ESAPI and for that matter in Apache Commons FileUpload as well. Related to CVE-2023-24998 Patches ESAPI 2.5.2.0 or later. Workarounds - See the 'Solutions' section of Security Bulletin 11, in the References section. If you are not using ESAPI file uploads, see also the 'Workarounds' section. - Deploy an external WAF or other suitable DoS protection. - Add additional defenses to your code using HTTPUtilities.getFileUpload, such as requiring prior authentication, restricting how many / much content can be uploaded per user per day or per hour, etc. (It is the opinion of the ESAPI development team that such required controls should not be added to ESAPI because it is a general purpose security library and thus ESAPI ought not be enforcing generic policies like these on everyone, especially it it could break existing code bases.) References "Security Bulletin 11: How Does CVE-2023-24998 Impact ESAPI?" (https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin11.pdf) New ESAPI 2.5.2.0 or later Javadoc on HTTPUtilities.getFileUploads: https://javadoc.io/static/org.owasp.esapi/esapi/2.5.2.0/org/owasp/esapi/HTTPUtilities.html#getFileUploads-javax.servlet.http.HttpServletRequest-java.io.File-java.util.List- (Note: This link won't work until the 2.5.2.0 release is made official.) Final Word (Especially to GitHub Advance Security team / GitHub as a CNA) -- I do not really wish to file a CVE for this. I had originally considered it, but there is no real way to address the general DoS scenarios for file uploads without breaking ESAPI client code which we are not willing to do. The clients have to take some responsibility for this themselves. In the next ESAPI release, I am going to add a reference to the appropriate Javadoc to this GitHub Security Advisory, but that's the best we can do. If you wish to discuss this with me, please first contact me via email at kevin.w.wall@gmail.com.

Publish Date: 2026-05-15

URL: WS-2023-0388

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-7c2q-5qmr-v76q

Release Date: 2024-12-06

Fix Resolution: org.owasp.esapi:esapi:2.5.2.0

⛑️ Automatic Remediation will be attempted for this issue.

WS-2014-0034

Vulnerable Library - commons-fileupload-1.3.3.jar

The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.

Library home page: https://www.apache.org/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-fileupload/commons-fileupload/1.3.3/commons-fileupload-1.3.3.jar

Dependency Hierarchy:

• esapi-2.3.0.0.jar (Root Library)
  • ❌ commons-fileupload-1.3.3.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DatabaseHelper (Application)
  -> org.owasp.esapi.ESAPI (Extension)
   -> org.owasp.esapi.reference.DefaultHTTPUtilities (Extension)
    -> org.apache.commons.fileupload.servlet.ServletFileUpload (Extension)
     -> ❌ org.apache.commons.fileupload.FileUploadBase (Vulnerable Component)

Vulnerability Details

The class FileUploadBase in Apache Commons Fileupload before 1.4 has potential resource leak - InputStream not closed on exception.

Publish Date: 2026-05-13

URL: WS-2014-0034

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://www.mend.io/vulnerability-database/WS-2014-0034

Release Date: 2026-05-13

Fix Resolution: apace - no_fix,flapjack - no_fix,tikiwiki/diagram - v15.8.8,tikiwiki/diagram - v13.10.5,vufind/vufind - v3.1,xjryanse/admin - v0.0.1,tikiwiki/diagram - v13.9.7,lizetheb1920/high-chart - no_fix,dcrphp/core - 1.0.1,xjryanse/admin - v0.1.15,appdynamics.azure.siteextension.java - 20.6.0.1,dcrphp/core - 1.0.7-alpha3,flash20/yii2-adminh-asset - no_fix,bioconductor-rdavidwebservice - no_fix,tikiwiki/diagram - v13.6.6,xorti/mxgraph-editor - v3.9.8,commons-fileupload:commons-fileupload:1.4,geek1992/tp5_rbac - 1.0.0,io/fe - v0.0.1,vufind/vufind - dev-release-5.0,ratku.framework.web - 1.2.0.520,geek1992/tp5_rbac - no_fix,cromwell - 0.26,ch4o5/x-tek_cmf - no_fix,tikiwiki/diagram - v15.7.4,vufind/vufind - dev-pullrequest_accessib_turn-my-account-menu-into-ul,existdb - no_fix,vufind/vufind - dev-legacy/mink-autoretry,tikiwiki/diagram - v14.2.8,purepanel/dashboard-module - v1.1.2,eslider/solr - no_fix,tikiwiki/diagram - v14.1.2

GHSA-7c2q-5qmr-v76q

Vulnerable Library - esapi-2.3.0.0.jar

The Enterprise Security API (ESAPI) project is an OWASP project to create simple strong security controls for every web platform. Security controls are not simple to build. You can read about the hundreds of pitfalls for unwary developers on the OWASP web site. By providing developers with a set of strong controls, we aim to eliminate some of the complexity of creating secure web applications. This can result in significant cost savings across the SDLC.

Library home page: https://owasp.org/www-project-enterprise-security-api/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.3.0.0/esapi-2.3.0.0.jar

Dependency Hierarchy:

• ❌ esapi-2.3.0.0.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DatabaseHelper (Application)
  -> org.owasp.esapi.ESAPI (Extension)
   -> ❌ org.owasp.esapi.Randomizer (Vulnerable Component)

Vulnerability Details

Impact ESAPI 2.5.2.0 and later addressed the DoS vulnerability described in CVE-2023-24998, which Apache Commons FileUpload 1.5 attempted to remediate. But while writing up a new security bulletin regarding the impact on the affected ESAPI "HTTPUtilities.getFileUploads" methods (or more specifically those methods in the "DefaultHTTPUtilities" implementation class), I realized that a DoS vulnerability still persists in ESAPI and for that matter in Apache Commons FileUpload as well. Related to CVE-2023-24998 Patches ESAPI 2.5.2.0 or later. Workarounds - See the 'Solutions' section of Security Bulletin 11, in the References section. If you are not using ESAPI file uploads, see also the 'Workarounds' section. - Deploy an external WAF or other suitable DoS protection. - Add additional defenses to your code using HTTPUtilities.getFileUpload, such as requiring prior authentication, restricting how many / much content can be uploaded per user per day or per hour, etc. (It is the opinion of the ESAPI development team that such required controls should not be added to ESAPI because it is a general purpose security library and thus ESAPI ought not be enforcing generic policies like these on everyone, especially it it could break existing code bases.) References "Security Bulletin 11: How Does CVE-2023-24998 Impact ESAPI?" (https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin11.pdf) New ESAPI 2.5.2.0 or later Javadoc on HTTPUtilities.getFileUploads: https://javadoc.io/static/org.owasp.esapi/esapi/2.5.2.0/org/owasp/esapi/HTTPUtilities.html#getFileUploads-javax.servlet.http.HttpServletRequest-java.io.File-java.util.List- (Note: This link won't work until the 2.5.2.0 release is made official.) Final Word (Especially to GitHub Advance Security team / GitHub as a CNA) -- I do not really wish to file a CVE for this. I had originally considered it, but there is no real way to address the general DoS scenarios for file uploads without breaking ESAPI client code which we are not willing to do. The clients have to take some responsibility for this themselves. In the next ESAPI release, I am going to add a reference to the appropriate Javadoc to this GitHub Security Advisory, but that's the best we can do. If you wish to discuss this with me, please first contact me via email at kevin.w.wall@gmail.com.

Publish Date: 2026-01-29

URL: GHSA-7c2q-5qmr-v76q

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-7c2q-5qmr-v76q

Release Date: 2025-09-29

Fix Resolution: org.owasp.esapi:esapi:2.5.2.0,org.owasp.esapi:esapi:2.5.2.0

CVE-2023-24998

Vulnerable Library - commons-fileupload-1.3.3.jar

The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications.

Library home page: https://www.apache.org/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-fileupload/commons-fileupload/1.3.3/commons-fileupload-1.3.3.jar

Dependency Hierarchy:

• esapi-2.3.0.0.jar (Root Library)
  • ❌ commons-fileupload-1.3.3.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DatabaseHelper (Application)
  -> org.owasp.esapi.ESAPI (Extension)
   -> org.owasp.esapi.reference.DefaultHTTPUtilities (Extension)
    -> org.apache.commons.fileupload.servlet.ServletFileUpload (Extension)
     -> ❌ org.apache.commons.fileupload.FileUploadBase (Vulnerable Component)

Vulnerability Details

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.

Note that, like all of the file upload limits, the
new configuration option (FileUploadBase#setFileCountMax) is not
enabled by default and must be explicitly configured.

Publish Date: 2023-02-20

URL: CVE-2023-24998

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-hfrx-6qgj-fp6c

Release Date: 2023-02-20

Fix Resolution: commons-fileupload:commons-fileupload:1.5,org.apache.tomcat:tomcat-coyote:9.0.71,org.apache.tomcat:tomcat-coyote:10.1.5,org.apache.tomcat:tomcat-coyote:8.5.88,org.apache.tomcat.embed:tomcat-embed-core:8.5.88,org.apache.tomcat.embed:tomcat-embed-core:11.0.0-M5,org.apache.tomcat.embed:tomcat-embed-core:10.1.5,org.apache.tomcat:tomcat-coyote:11.0.0-M5,org.apache.tomcat.embed:tomcat-embed-core:9.0.71

CVE-2021-4104

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Library home page: http://www.apache.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

• esapi-2.3.0.0.jar (Root Library)
  • ❌ log4j-1.2.17.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DatabaseHelper (Application)
  -> org.owasp.esapi.ESAPI (Extension)
   -> org.owasp.esapi.logging.log4j.Log4JLogFactory (Extension)
    -> org.apache.log4j.Logger (Extension)
     -> ❌ org.apache.log4j.net.JMSAppender (Vulnerable Component)

Vulnerability Details

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Publish Date: 2021-12-14

URL: CVE-2021-4104

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-4104

Release Date: 2021-12-14

Fix Resolution: uom-parent - 1.0.3-3.module,1.0.3-3.module;uom-se-javadoc - 1.0.4-3.module;parfait-examples - 0.5.4-4.module;log4j-manual - 1.2.17-16;si-units-javadoc - 0.6.5-2.module;unit-api - 1.0-5.module,1.0-5.module;unit-api-javadoc - 1.0-5.module;parfait - 0.5.4-4.module,0.5.4-4.module;log4j-javadoc - 1.2.17-16;uom-systems-javadoc - 0.7-1.module;uom-lib-javadoc - 1.0.1-6.module;uom-systems - 0.7-1.module,0.7-1.module;log4j - 1.2.17-16,1.2.17-16;uom-se - 1.0.4-3.module,1.0.4-3.module;uom-lib - 1.0.1-6.module,1.0.1-6.module;parfait-javadoc - 0.5.4-4.module;pcp-parfait-agent - 0.5.4-4.module;si-units - 0.6.5-2.module,0.6.5-2.module

CVE-2025-46392

Vulnerable Library - commons-configuration-1.10.jar

Tools to assist in the reading of configuration/preferences files in various formats.

Library home page: http://www.apache.org/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-configuration/commons-configuration/1.10/commons-configuration-1.10.jar

Dependency Hierarchy:

• esapi-2.3.0.0.jar (Root Library)
  • ❌ commons-configuration-1.10.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DatabaseHelper (Application)
  -> org.owasp.esapi.ESAPI (Extension)
   -> org.owasp.esapi.reference.accesscontrol.ExperimentalAccessController (Extension)
    -> org.apache.commons.configuration.XMLConfiguration (Extension)
    ...
      -> org.apache.commons.configuration.HierarchicalConfiguration$5 (Extension)
       -> org.apache.commons.configuration.MultiFileHierarchicalConfiguration (Extension)
        -> ❌ org.apache.commons.configuration.resolver.EntityResolverSupport (Vulnerable Component)

Vulnerability Details

Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x.
There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuration team does not intend to fix these issues in 1.x. Apache Commons Configuration 1.x is still safe to use in scenario's where you only load trusted configurations.
Users that load untrusted configurations or give attackers control over usage patterns are recommended to upgrade to the 2.x version line, which fixes these issues. Apache Commons Configuration 2.x is not a drop-in replacement, but as it uses a separate Maven groupId and Java package namespace they can be loaded side-by-side, making it possible to do a gradual migration.

Publish Date: 2025-05-09

URL: CVE-2025-46392

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread/y1pl0mn3opz6kwkm873zshjdxq3dwq5s

Release Date: 2025-05-09

Fix Resolution: commons-configuration:commons-configuration:2.0

WS-2023-0429

Vulnerable Library - esapi-2.3.0.0.jar

The Enterprise Security API (ESAPI) project is an OWASP project to create simple strong security controls for every web platform. Security controls are not simple to build. You can read about the hundreds of pitfalls for unwary developers on the OWASP web site. By providing developers with a set of strong controls, we aim to eliminate some of the complexity of creating secure web applications. This can result in significant cost savings across the SDLC.

Library home page: https://owasp.org/www-project-enterprise-security-api/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.3.0.0/esapi-2.3.0.0.jar

Dependency Hierarchy:

• ❌ esapi-2.3.0.0.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DatabaseHelper (Application)
  -> org.owasp.esapi.ESAPI (Extension)
   -> ❌ org.owasp.esapi.reference.DefaultValidator (Vulnerable Component)

Vulnerability Details

The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service.

Publish Date: 2026-05-15

URL: WS-2023-0429

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-r68h-jhhj-9jvm

Release Date: 2024-12-07

Fix Resolution: org.owasp.esapi:esapi:2.6.0.0

⛑️ Automatic Remediation will be attempted for this issue.

GHSA-r68h-jhhj-9jvm

Vulnerable Library - esapi-2.3.0.0.jar

The Enterprise Security API (ESAPI) project is an OWASP project to create simple strong security controls for every web platform. Security controls are not simple to build. You can read about the hundreds of pitfalls for unwary developers on the OWASP web site. By providing developers with a set of strong controls, we aim to eliminate some of the complexity of creating secure web applications. This can result in significant cost savings across the SDLC.

Library home page: https://owasp.org/www-project-enterprise-security-api/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/owasp/esapi/esapi/2.3.0.0/esapi-2.3.0.0.jar

Dependency Hierarchy:

• ❌ esapi-2.3.0.0.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.LDAPManager (Application)
  -> org.owasp.esapi.reference.DefaultEncoder (Extension)
   -> ❌ org.owasp.esapi.codecs.CSSCodec (Vulnerable Component)

Vulnerability Details

Impact The "Validator.isValidSafeHTML" method can result in false negatives where it reports some input as safe (i.e., returns true), but really isn't, and using that same input as-is can in certain circumstances result in XSS vulnerabilities. Because this method cannot be fixed, it is being deprecated and will be removed in one years time from when this advisory is published. Full details may be found in "ESAPI Security Bulletin #⁠12" (https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin12.pdf). Note that all versions of ESAPI, that have this method (which dates back to at least the ESAPI 1.3 release more than 15 years ago) have this issue and it will continue to exist until we remove these two methods in a future ESAPI release. Patches There is no patch. We do not believe that it is possible to patch this pretentiously named method other then perhaps renaming it to something like Validator.mightThisBeValidSafeHTML to dissuade developers from using it. Workarounds Stop using this method. Note that "Validator.getValidSafeHTML" is believed to be safe to use with the default antisamy-esapi.xml AntiSamy policy file. Why is no CVE being filed? We outline the reasons in the section "Why no CVE for this issue?" in "ESAPI Security Bulletin #⁠12" (https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin12.pdf). If after reading that, if you still want to file a CVE or this, knock yourself out. References "CWE-79" (https://cwe.mitre.org/data/definitions/79.html) "CWE-80" (https://cwe.mitre.org/data/definitions/80.html) "ESAPI Security Bulletin #⁠12" (https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin12.pdf) Final resolution This GitHub Security Advisory should now be considered remediated in "ESAPI versions 2.6.0.0" (https://github.com/ESAPI/esapi-java-legacy/releases/tag/esapi-2.6.0.0) and later as the deprecated methods have been removed from the ESAPI jar.

Publish Date: 2026-03-04

URL: GHSA-r68h-jhhj-9jvm

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-r68h-jhhj-9jvm

Release Date: 2025-09-29

Fix Resolution: org.owasp.esapi:esapi:2.6.0.0,org.owasp.esapi:esapi:2.6.0.0,org.owasp.esapi:esapi:2.6.0.0

CVE-2021-29425

Vulnerable Library - commons-io-2.6.jar

The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.

Library home page: https://www.apache.org/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-io/commons-io/2.6/commons-io-2.6.jar

Dependency Hierarchy:

• esapi-2.3.0.0.jar (Root Library)
  • ❌ commons-io-2.6.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DatabaseHelper (Application)
  -> org.owasp.esapi.ESAPI (Extension)
   -> org.owasp.esapi.reference.DefaultHTTPUtilities (Extension)
    -> org.apache.commons.io.FileCleaningTracker (Extension)
    ...
      -> org.apache.commons.io.FileDeleteStrategy$ForceFileDeleteStrategy (Extension)
       -> org.apache.commons.io.FileUtils (Extension)
        -> ❌ org.apache.commons.io.FilenameUtils (Vulnerable Component)

Vulnerability Details

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2021-04-13

URL: CVE-2021-29425

CVSS 3 Score Details (4.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-gwrp-pvrq-jmwv

Release Date: 2021-04-13

Fix Resolution (commons-io:commons-io): 2.7

Direct dependency fix Resolution (org.owasp.esapi:esapi): 2.5.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-9488

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Library home page: http://www.apache.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

• esapi-2.3.0.0.jar (Root Library)
  • ❌ log4j-1.2.17.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.benchmark.helpers.DatabaseHelper (Application)
  -> org.owasp.esapi.ESAPI (Extension)
   -> org.owasp.esapi.reference.DefaultValidator (Extension)
    -> org.slf4j.impl.StaticLoggerBinder (Extension)
    ...
      -> org.apache.log4j.LogManager (Extension)
       -> org.apache.log4j.spi.RootLogger (Extension)
        -> ❌ org.apache.log4j.net.SMTPAppender (Vulnerable Component)

Vulnerability Details

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

Publish Date: 2020-04-27

URL: CVE-2020-9488

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-vwqq-5vrc-xw9h

Release Date: 2020-04-27

Fix Resolution: org.apache.logging.log4j:log4j-core:2.3.2,org.apache.logging.log4j:log4j:2.13.2,org.apache.logging.log4j:log4j:2.12.3,org.apache.logging.log4j:log4j:2.3.2,org.apache.logging.log4j:log4j-core:2.13.2,org.apache.logging.log4j:log4j-core:2.12.3

CVE-2020-9493

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Library home page: http://www.apache.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

• esapi-2.3.0.0.jar (Root Library)
  • ❌ log4j-1.2.17.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.

Publish Date: 2021-06-16

URL: CVE-2020-9493

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://www.openwall.com/lists/oss-security/2021/06/16/1

Release Date: 2021-06-16

Fix Resolution: ch.qos.reload4j:reload4j:1.2.18.1

CVE-2019-17571

Vulnerable Library - log4j-1.2.17.jar

Apache Log4j 1.2

Library home page: http://www.apache.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/log4j/log4j/1.2.17/log4j-1.2.17.jar

Dependency Hierarchy:

• esapi-2.3.0.0.jar (Root Library)
  • ❌ log4j-1.2.17.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Publish Date: 2019-12-20

URL: CVE-2019-17571

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E

Release Date: 2019-12-20

Fix Resolution: log4j-manual - 1.2.17-16;log4j-javadoc - 1.2.17-16;log4j - 1.2.17-16,1.2.17-16

CVE-2024-47554

Vulnerable Library - commons-io-2.6.jar

The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.

Library home page: https://www.apache.org/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-io/commons-io/2.6/commons-io-2.6.jar

Dependency Hierarchy:

• esapi-2.3.0.0.jar (Root Library)
  • ❌ commons-io-2.6.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Uncontrolled Resource Consumption vulnerability in Apache Commons IO.
The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.
This issue affects Apache Commons IO: from 2.0 before 2.14.0.
Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2024-10-03

URL: CVE-2024-47554

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: GHSA-78wr-2p64-hpwj

Release Date: 2024-10-03

Fix Resolution (commons-io:commons-io): 2.14.0

Direct dependency fix Resolution (org.owasp.esapi:esapi): 2.7.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-106848-507795

Vulnerable Library - commons-io-2.6.jar

The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.

Library home page: https://www.apache.org/

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-io/commons-io/2.6/commons-io-2.6.jar

Dependency Hierarchy:

• esapi-2.3.0.0.jar (Root Library)
  • ❌ commons-io-2.6.jar (Vulnerable Library)

Found in HEAD commit: 3fb13535ce3a5993f2bc2b02a3ece468e691a942

Found in base branch: master

Vulnerability Details

Created automatically by the test suite

Publish Date: 2010-06-07

URL: CVE-106848-507795

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High