WS-2016-7062 (Medium) detected in plexus-utils-3.0.22.jar - autoclosed

[mend-for-github-com]

WS-2016-7062 - Medium Severity Vulnerability

Vulnerable Library - plexus-utils-3.0.22.jar

A collection of various utility classes to ease working with strings, files, command lines, XML and more.

Path to dependency file: legend-pure/legend-pure-maven-java-compiled/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/codehaus/plexus/plexus-utils/3.0.22/plexus-utils-3.0.22.jar,/home/wss-scanner/.m2/repository/org/codehaus/plexus/plexus-utils/3.0.22/plexus-utils-3.0.22.jar

Dependency Hierarchy:

• maven-plugin-api-3.3.9.jar (Root Library)
  • maven-model-3.3.9.jar
    • ❌ plexus-utils-3.0.22.jar (Vulnerable Library)

Found in HEAD commit: 03d9649e7cc4bc5afd2bcf813b6ffea681a17ab8

Found in base branch: master

Vulnerability Details

Security vulnerability found in plexus-utils before 3.0.24. XML injection found in XmlWriterUtil.java.

Publish Date: 2016-05-07

URL: WS-2016-7062

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: codehaus-plexus/plexus-utils@f933e5e

Release Date: 2019-09-26

Fix Resolution: 3.0.24

[mend-for-github-com]

✔️ This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.