Insecure XML deserialization Affecting org.jbehave:jbehave-core Open this link in a new tab package, versions [3.2-alpha,3.3-beta-2)
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
25 Dec 2016
22 Dec 2013
How to fix?
org.jbehave:jbehave-core to version 3.3-beta-2 or higher.
org.jbehave:jbehave-core is a JBehave Core contains all the core functionality for running BDD stories.
Affected versions of this package are vulnerable to Insecure XML deserialization. It could deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application.