[Snyk] Upgrade com.thoughtworks.xstream:xstream from 1.4.5 to 1.4.20 by msant262 · Pull Request #5 · msant262/WebGoat

msant262 · 2023-11-17T18:49:13Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade com.thoughtworks.xstream:xstream from 1.4.5 to 1.4.20.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 22 versions ahead of your current version.
The recommended version was released a year ago, on 2022-12-23.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Deserialization of Untrusted Data SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1088337	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Deserialization of Untrusted Data SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1040458	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
XML External Entity (XXE) Injection SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-30385	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	No Known Exploit
Denial of Service (DoS) SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-31394	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	No Known Exploit
Arbitrary Code Execution SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1569176	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Arbitrary Code Execution SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1569177	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Arbitrary Code Execution SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1569178	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Arbitrary Code Execution SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1569179	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Arbitrary Code Execution SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1569180	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Arbitrary Code Execution SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1569181	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Arbitrary Code Execution SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1569182	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Remote Code Execution (RCE) SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1569183	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Mature
Arbitrary Code Execution SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1569185	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Arbitrary Code Execution SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1569186	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Arbitrary Code Execution SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1569187	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Server-Side Request Forgery (SSRF) SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1569190	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Server-Side Request Forgery (SSRF) SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1569191	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Denial of Service (DoS) SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-2388977	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	No Known Exploit
Deserialization of Untrusted Data SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1088335	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Deserialization of Untrusted Data SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1088336	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Deserialization of Untrusted Data SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1088338	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Deserialization of Untrusted Data SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1294540	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Arbitrary File Deletion SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1051966	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Server-Side Request Forgery (SSRF) SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1051967	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Mature
Deserialization of Untrusted Data SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1088328	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Deserialization of Untrusted Data SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1088329	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Deserialization of Untrusted Data SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1088330	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Deserialization of Untrusted Data SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1088331	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Deserialization of Untrusted Data SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1088332	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Deserialization of Untrusted Data SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1088333	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Deserialization of Untrusted Data SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1088334	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Denial of Service (DoS) SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-3091180	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	No Known Exploit
Denial of Service (DoS) SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-3182897	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept
Insecure XML deserialization SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-460764	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Mature
Denial of Service (DoS) SNYK-JAVA-COMTHOUGHTWORKSXSTREAM-1569189	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade com.thoughtworks.xstream:xstream from 1.4.5 to 1.4.20. See this package in Maven Repository: https://mvnrepository.com/artifact/com.thoughtworks.xstream/xstream/ See this project in Snyk: https://app.snyk.io/org/msant262/project/0fbc85c7-7c92-4d5b-8139-1eba513566a9?utm_source=github&utm_medium=referral&page=upgrade-pr

sonarqubecloud · 2023-11-17T18:50:21Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

msant262 · 2023-11-17T18:57:55Z

Checkmarx One – Scan Summary & Details – 23dd75ab-e7f1-4b26-95f3-8b3b436fc74b

Fixed Issues

Severity	Issue	Source File / Package
	CVE-2013-7285	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2016-3674	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2017-7957	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2020-26217	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2020-26258	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-21341	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-21342	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-21343	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-21344	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-21345	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-21346	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-21347	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-21348	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-21349	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-21350	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-21351	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-29505	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-39139	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-39141	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-39144	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-39145	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-39146	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-39147	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-39148	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-39149	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-39150	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-39151	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-39152	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-39153	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-39154	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-43859	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2022-40151	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2022-40152	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2022-41966	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2020-26259	Maven-com.thoughtworks.xstream:xstream-1.4.5
	CVE-2021-39140	Maven-com.thoughtworks.xstream:xstream-1.4.5

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade com.thoughtworks.xstream:xstream from 1.4.5 to 1.4.20#5

[Snyk] Upgrade com.thoughtworks.xstream:xstream from 1.4.5 to 1.4.20#5
msant262 wants to merge 1 commit intodevelopfrom
snyk-upgrade-42ef89a40caf951844d93e29cebdd3da

msant262 commented Nov 17, 2023

Uh oh!

sonarqubecloud bot commented Nov 17, 2023

Uh oh!

msant262 commented Nov 17, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

msant262 commented Nov 17, 2023

Snyk has created this PR to upgrade com.thoughtworks.xstream:xstream from 1.4.5 to 1.4.20.

Uh oh!

sonarqubecloud bot commented Nov 17, 2023

Uh oh!

msant262 commented Nov 17, 2023

Fixed Issues

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants