CVE-2014-125087 (Critical) detected in java-xmlbuilder-1.0.jar

[mend-for-github-com]

CVE-2014-125087 - Critical Severity Vulnerability

Vulnerable Library - java-xmlbuilder-1.0.jar

XML Builder is a utility that creates simple XML documents using relatively sparse Java code

Library home page: https://github.com/jmurty/java-xmlbuilder

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.jamesmurty.utils/java-xmlbuilder/1.0/4a6507aa7da3d7db5dd23eedf1185649384c3bc3/java-xmlbuilder-1.0.jar

Dependency Hierarchy:

• spark-sql_2.11-2.2.3.jar (Root Library)
  • spark-core_2.11-2.2.3.jar
    • jets3t-0.9.3.jar
      • ❌ java-xmlbuilder-1.0.jar (Vulnerable Library)

Found in HEAD commit: b23ac4a35a28378635d7eef881077d376557bfc5

Found in base branch: master

Vulnerability Details

A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is e6fddca201790abab4f2c274341c0bb8835c3e73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221480.

Publish Date: 2023-02-19

URL: CVE-2014-125087

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-02-19

Fix Resolution (com.jamesmurty.utils:java-xmlbuilder): 1.2

Direct dependency fix Resolution (org.apache.spark:spark-sql_2.11): 2.3.0

---

⛑️ Automatic Remediation will be attempted for this issue.