Homepage

org.jbehave:jbehave-core@3.2-beta-4 vulnerabilities

  • latest version

    5.2.0

  • latest non vulnerable version

    5.2.0

  • first published

    16 years ago

  • latest version published

    1 years ago

  • licenses detected

  • package manager

    View on Maven Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.jbehave:jbehave-core package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Insecure XML deserialization

    org.jbehave:jbehave-core is a JBehave Core contains all the core functionality for running BDD stories.

    Affected versions of this package are vulnerable to Insecure XML deserialization. It could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.

    How to fix Insecure XML deserialization?

    Upgrade org.jbehave:jbehave-core to version 3.3-beta-2 or higher.

    [3.2-alpha,3.3-beta-2)
    • H
    Information Exposure

    org.jbehave:jbehave-core Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.

    [3.2-alpha,3.3-beta-2)
    Go back to all versions of this package