CVE-2013-5035 (Medium) detected in htmlcleaner-2.4.jar

[mend-bolt-for-github]

CVE-2013-5035 - Medium Severity Vulnerability

Vulnerable Library - htmlcleaner-2.4.jar

HtmlCleaner is an HTML parser written in Java. It transforms dirty HTML to well-formed XML following the same rules that most web-browsers use.

Library home page: http://htmlcleaner.sourceforge.net/

Path to vulnerable library: /cache/net.sourceforge.htmlcleaner/htmlcleaner/jars/htmlcleaner-2.4.jar

Dependency Hierarchy:

• ❌ htmlcleaner-2.4.jar (Vulnerable Library)

Found in HEAD commit: 8eac03065710eeeacc8ff5bd28397cc15a674b57

Vulnerability Details

Multiple race conditions in HtmlCleaner before 2.6, as used in Open-Xchange AppSuite 7.2.2 before rev13 and other products, allow remote authenticated users to read the private e-mail of other persons in opportunistic circumstances by leveraging lack of thread safety and performing a rapid series of (1) mail-sending or (2) draft-saving operations.

Publish Date: 2013-09-05

URL: CVE-2013-5035

CVSS 2 Score Details (4.9)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2013-5035

Release Date: 2013-09-05

Fix Resolution: 2.6,rev13

---

Step up your Open Source Security Game with WhiteSource here