WS-2016-7062 (Medium) detected in plexus-utils-3.0.17.jar - autoclosed

[mend-for-github-com]

WS-2016-7062 - Medium Severity Vulnerability

Vulnerable Library - plexus-utils-3.0.17.jar

A collection of various utility classes to ease working with strings, files, command lines, XML and more.

Path to vulnerable library: swagger-core/modules/swagger-eclipse-transformer-maven-plugin/target/lib/plexus-utils-3.0.17.jar

Dependency Hierarchy:

• ❌ plexus-utils-3.0.17.jar (Vulnerable Library)

Found in HEAD commit: 6941fed9a46423b3615a4d8ecdbbdfc09fe6dec3

Found in base branch: master

Vulnerability Details

Security vulnerability found in plexus-utils before 3.0.24. XML injection found in XmlWriterUtil.java.

Publish Date: 2016-05-07

URL: WS-2016-7062

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: codehaus-plexus/plexus-utils@f933e5e

Release Date: 2019-09-26

Fix Resolution: 3.0.24

---

• Check this box to open an automated fix PR

[mend-for-github-com]

✔️ This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.