Homepage
About Snyk

org.jeecgframework.boot:jeecg-boot-base-core@3.0 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.jeecgframework.boot:jeecg-boot-base-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
SQL Injection

Affected versions of this package are vulnerable to SQL Injection through the /onlDragDatasetHead/getTotalData component. An attacker can manipulate the backend database and execute arbitrary SQL commands by injecting malicious SQL code into the input parameters.

How to fix SQL Injection?

There is no fixed version for org.jeecgframework.boot:jeecg-boot-base-core.

[0,)
  • C
SQL Injection

Affected versions of this package are vulnerable to SQL Injection via the /sys/replicate/check endpoint. An attacker can escalate privileges and obtain sensitive information by injecting malicious SQL queries.

How to fix SQL Injection?

There is no fixed version for org.jeecgframework.boot:jeecg-boot-base-core.

[0,)
  • H
SQL Injection

Affected versions of this package are vulnerable to SQL Injection via the /jeecg-boot/jmreport/show component due to improper user input sanitization. An attacker can manipulate SQL queries by injecting malicious SQL code.

How to fix SQL Injection?

A fix was pushed into the master branch but not yet published.

[0,)
  • M
SQL Injection

Affected versions of this package are vulnerable to SQL Injection which allows a local attacker to cause a denial of service via the Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE functions within the "/sys/duplicate/check" API endpoint.

How to fix SQL Injection?

Upgrade org.jeecgframework.boot:jeecg-boot-base-core to version 3.5.1 or higher.

[0,3.5.1)
  • H
SQL Injection

Affected versions of this package are vulnerable to SQL Injection due to improper input sanitization via the Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE functions. Exploiting this vulnerability allows a local attacker to cause a denial of service by utilizing the %09 encoding to replace space characters and leveraging the sleep() function.

Note: This vulnerability was fixed in version 3.5.1, which doesn't exist in the ecosystem.

How to fix SQL Injection?

A fix was pushed into the master branch but not yet published.

[0,)
  • H
SQL Injection

Affected versions of this package are vulnerable to SQL Injection due to improper input sanitization passed via the component queryTableDictItemsByCode at org.jeecg.modules.api.controller.SystemApiController.

How to fix SQL Injection?

A fix was pushed into the master branch but not yet published.

[0,)
  • M
SQL Injection

Affected versions of this package are vulnerable to SQL Injection in the /sys/dict/queryTableData component, whose injection protection mechanism can be bypassed with /*%0A*/.

How to fix SQL Injection?

A fix was pushed into the master branch but not yet published.

[0,)
  • H
Arbitrary File Upload

Affected versions of this package are vulnerable to Arbitrary File Upload via the file argument in the file upload component of the API.

How to fix Arbitrary File Upload?

There is no fixed version for org.jeecgframework.boot:jeecg-boot-base-core.

[0,)
  • H
SQL Injection

Affected versions of this package are vulnerable to SQL Injection via the component /sys/duplicate/check.

How to fix SQL Injection?

Upgrade org.jeecgframework.boot:jeecg-boot-base-core to version 3.4.4 or higher.

[,3.4.4)
  • M
Cross-site Scripting (XSS)

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via a mouseover event in /jeecg-boot/jmreport/view.

How to fix Cross-site Scripting (XSS)?

There is no fixed version for org.jeecgframework.boot:jeecg-boot-base-core.

[0,)
  • C
SQL Injection

Affected versions of this package are vulnerable to SQL Injection that can operate the database with root privileges.

How to fix SQL Injection?

A fix was pushed into the master branch but not yet published.

[0,)
Go back to all versions of this package