net.sf.mpxj:mpxj@5.5.6 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the net.sf.mpxj:mpxj package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • L
Creation of Temporary File With Insecure Permissions

net.sf.mpxj:mpxj is a Library that provides facilities to allow project information to be manipulated in Java and .Net.

Affected versions of this package are vulnerable to Creation of Temporary File With Insecure Permissions. A knowledgeable local user can locate temporary files created when a scheduled file is read. While they are in use, the user will be able to read the schedule being processed by MPXJ. This is because temporary files are being created with the permissions -rw-r--r--.

How to fix Creation of Temporary File With Insecure Permissions?

Upgrade net.sf.mpxj:mpxj to version 10.14.1 or higher.

[,10.14.1)
  • H
Directory Traversal

net.sf.mpxj:mpxj is a Library that provides facilities to allow project information to be manipulated in Java and .Net.

Affected versions of this package are vulnerable to Directory Traversal. common/InputStreamHelper.java allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.

How to fix Directory Traversal?

Upgrade net.sf.mpxj:mpxj to version 8.3.5 or higher.

[,8.3.5)
  • H
XML External Entity (XXE) Injection

net.sf.mpxj:mpxj is a Library that provides facilities to allow project information to be manipulated in Java and .Net.

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection via the GanttProjectReader and PhoenixReader components.

How to fix XML External Entity (XXE) Injection?

Upgrade net.sf.mpxj:mpxj to version 8.1.4 or higher.

[,8.1.4)