Homepage
About Snyk

commons-jelly:commons-jelly@1.0-dev vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the commons-jelly:commons-jelly package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • C
XML External Entity (XXE) Injection

commons-jelly:commons-jelly is a Java and XML based scripting engine. Jelly combines the best ideas from JSTL, Velocity, DVSL, Ant and Cocoon all together in a simple yet powerful scripting engine.

Affected versions of the package are vulnerable to XML External Entity (XXE) Injection. During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.

How to fix XML External Entity (XXE) Injection?

Upgrade commons-jelly:commons-jelly to version 1.0.1 or higher.

[,1.0.1)
Go back to all versions of this package