Homepage
About Snyk

org.directwebremoting:dwr@2.0.rc2 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.directwebremoting:dwr package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Scripting (XSS)

org.directwebremoting:dwr is a Java library that enables Java on the server and JavaScript in a browser to interact and call each other

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

How to fix Cross-site Scripting (XSS)?

Upgrade org.directwebremoting:dwr to version 2.0.11, 3.0.RC3 or higher.

[,2.0.11) [3-alpha,3.0.RC3)
  • M
Information Exposure

org.directwebremoting:dwr is a Java library that enables Java on the server and JavaScript in a browser to interact and call each other

Affected versions of this package are vulnerable to Information Exposure. The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

How to fix Information Exposure?

Upgrade org.directwebremoting:dwr to version 2.0.11, 3.0.RC3 or higher.

[,2.0.11) [3-alpha,3.0.RC3)
Go back to all versions of this package