Homepage

commons-jelly:commons-jelly@1.0-beta-1 vulnerabilities

  • latest version

    1.0.1

  • latest non vulnerable version

    20040902.070806

  • first published

    19 years ago

  • latest version published

    7 years ago

  • licenses detected

  • package manager

    View on Maven Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the commons-jelly:commons-jelly package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    XML External Entity (XXE) Injection

    commons-jelly:commons-jelly is a Java and XML based scripting engine. Jelly combines the best ideas from JSTL, Velocity, DVSL, Ant and Cocoon all together in a simple yet powerful scripting engine.

    Affected versions of the package are vulnerable to XML External Entity (XXE) Injection. During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.

    How to fix XML External Entity (XXE) Injection?

    Upgrade commons-jelly:commons-jelly to version 1.0.1 or higher.

    [,1.0.1)
    Go back to all versions of this package