8000 hsqldb-2.5.2.jar: 1 vulnerabilities (highest severity is: 8.0) reachable · Issue #32 · Uncleken13/WebGoat · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

hsqldb-2.5.2.jar: 1 vulnerabilities (highest severity is: 8.0) reachable #32

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
mend-for-github-com bot opened this issue Mar 20, 2023 · 0 comments
Open

hsqldb-2.5.2.jar: 1 vulnerabilities (highest severity is: 8.0) reachable #32

mend-for-github-com bot opened this issue Mar 20, 2023 · 0 comments
8000
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend

Comments

@mend-for-github-com
Copy link
mend-for-github-com bot commented Mar 20, 2023 •
edited
Loading
Vulnerable Library - hsqldb-2.5.2.jar

HSQLDB - Lightweight 100% Java SQL Database Engine

Library home page: http://hsqldb.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/hsqldb/hsqldb/2.5.2/hsqldb-2.5.2.jar

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (hsqldb version) Remediation Possible** Reachability
CVE-2022-41853 High 8.0 Not Defined 70.6% hsqldb-2.5.2.jar Direct 2.7.1 ✅

Reachable

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-41853

Vulnerable Library - hsqldb-2.5.2.jar

HSQLDB - Lightweight 100% Java SQL Database Engine

Library home page: http://hsqldb.org

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/hsqldb/hsqldb/2.5.2/hsqldb-2.5.2.jar

Dependency Hierarchy:

  • ❌ hsqldb-2.5.2.jar (Vulnerable Library)

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.webgoat.lessons.sqlinjection.introduction.SqlInjectionLesson9 (Application)
  -> org.hsqldb.jdbc.JDBCResultSet (Extension)
   -> ❌ org.hsqldb.persist.HsqlDatabaseProperties (Vulnerable Component)

Vulnerability Details

Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.

Publish Date: 2022-10-06

URL: CVE-2022-41853

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 70.6%

CVSS 3 Score Details (8.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-77xx-rxvh-q682

Release Date: 2022-10-06

Fix Resolution: 2.7.1

In order to enable automatic remediation, please create workflow rules

In order to enable automatic remediation for this issue, please create workflow rules
@mend-for-github-com mend-for-github-com bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label Mar 20, 2023
@mend-for-github-com mend-for-github-com bot changed the title hsqldb-2.5.2.jar: 1 vulnerabilities (highest severity is: 9.8) hsqldb-2.5.2.jar: 1 vulnerabilities (highest severity is: 9.8) reachable Jan 17, 2024
@mend-for-github-com mend-for-github-com bot changed the title hsqldb-2.5.2.jar: 1 vulnerabilities (highest severity is: 9.8) reachable hsqldb-2.5.2.jar: 1 vulnerabilities (highest severity is: 8.0) reachable Sep 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
0 participants
0