Homepage
About Snyk

org.jbehave:jbehave-core@3.2-beta-3 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.jbehave:jbehave-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Insecure XML deserialization

org.jbehave:jbehave-core is a JBehave Core contains all the core functionality for running BDD stories.

Affected versions of this package are vulnerable to Insecure XML deserialization. It could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.

How to fix Insecure XML deserialization?

Upgrade org.jbehave:jbehave-core to version 3.3-beta-2 or higher.

[3.2-alpha,3.3-beta-2)
  • H
Information Exposure

org.jbehave:jbehave-core Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.

[3.2-alpha,3.3-beta-2)
Go back to all versions of this package