Maven Advisories.

Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor

• Cross-site request forgery (CSRF)

>=2023.Q4.0, <2023.Q4.3 || >=2023.Q3.1, <2023.Q3.6 || >=7.4.GA, <7.4u93 || >=7.3u29, <7.3u36 · fixed in 2023.Q4.3, 2023.Q3.6, 7.4u93, 7.3u36

Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console

• Cross-site request forgery (CSRF)

>=2023.Q3.1, <2023.Q3.5 || >=7.0.0-GA, <=7.0.10.fp102 || >=7.1.0-GA, <=7.1.10.fp28 || >=7.2.0.GA, <=7.2.10.fp20 || >=7.3.0-GA, <7.3.10.u36 || >=7.4.0-GA, <=7.4.13.u92 · fixed in 2023.Q3.5, 7.3.10.u36

Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account Widget

• Cross-site request forgery (CSRF)

>=2023.Q4.0, <2023.Q4.3 || >=2023.Q3.1, <2023.Q3.6 || >=7.3u32, <7.3u37 || >=7.4u75, <7.4u93 · fixed in 2023.Q4.3, 2023.Q3.6, 7.3u37, 7.4u93

Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions

• Broken access control

>=2023.Q4.0, <2023.Q4.6 || >=2023.Q3.1, <2023.Q3.9 || >=7.3-ga, <7.3.10.u36 || >=7.4-ga, <7.4.13.u92 · fixed in 2023.Q4.6, 2023.Q3.9, 7.3.10.u36, 7.4.13.u92

Spring Framework DataBinder Case Sensitive Match Exception

• CWE-178

>=6.1.0, <6.1.14 || >=6.0.0, <=6.0.24 || <=5.3.40 · fixed in 6.1.14

JetBrains Ktor information disclosure

• CWE-524

<2.3.13 · fixed in 2.3.13

Improper Authentication vulnerability in Apache Solr

• Authentication bypass
• Broken access control

>=5.3.0, <8.11.4 || >=9.0.0, <9.7.0 · fixed in 8.11.4, 9.7.0

Insecure Default Initialization of Resource vulnerability in Apache Solr

• CWE-1188

>=6.6.0, <8.11.4 || >=9.0.0, <9.7.0 · fixed in 8.11.4, 9.7.0

SAK-50571 Sakai Kernel users created with type roleview can login as a normal user

• Broken access control

>=23.0, <23.3 · fixed in 23.3

Eclipse Jetty URI parsing of invalid authority

• CWE-1286

>=7.0.0, <12.0.12 · fixed in 12.0.12

Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks

• Denial of service

>=12.0.0, <12.0.9 || >=10.0.0, <10.0.24 || >=11.0.0, <11.0.24 || >=9.3.12, <9.4.56 · fixed in 12.0.9, 10.0.24, 11.0.24, 9.4.56

Eclipse Jetty's PushSessionCacheFilter can cause remote DoS attacks

• Denial of service

>=10.0.0, <10.0.18 || >=11.0.0, <11.0.18 || >=12.0.0, <12.0.4 · fixed in 10.0.18, 11.0.18, 12.0.4

Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity

• CWE-324

<24.0.7 || >=25.0.0, <25.0.4 · fixed in 24.0.7, 25.0.4

Keycloak has session fixation in Elytron SAML adapters

• Authentication bypass

<22.0.12 || >=23.0.0, <24.0.7 || >=25.0.0, <25.0.5 · fixed in 22.0.12, 24.0.7, 25.0.5

Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect

• Open redirect

<22.0.13 || >=23.0.0, <24.0.8 || >=25.0.0, <25.0.6 · fixed in 22.0.13, 24.0.8, 25.0.6

Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak

• Weak cryptography or TLS

<22.0.13 || >=23.0.0, <24.0.8 || >=25.0.0, <25.0.6 · fixed in 22.0.13, 24.0.8, 25.0.6

Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans

• Broken access control

<2.29.0 · fixed in 2.29.0

Eclipse Jetty has a denial of service vulnerability on DosFilter

• Denial of service

>=12.0.0, <12.0.3 · fixed in 12.0.3

pac4j-core affected by a Java deserialization vulnerability

• Insecure deserialization

<4.0.0 · fixed in 4.0.0

JSONPath Plus Remote Code Execution (RCE) Vulnerability

• Code injection

<=6.0.1 · no fixed version yet

Apache XML Graphics FOP XML External Entity Reference ('XXE') vulnerability

• XML external entities (XXE)

<2.10 · fixed in 2.10

Quarkus CXF logs passwords and other secrets

• Information disclosure

<3.15.2 · fixed in 3.15.2

HTTP Request Smuggling Leading to Client Timeouts in resteasy-netty4

• HTTP request smuggling

* · no fixed version yet

JSON-lib mishandles an unbalanced comment string

<=2.4 · no fixed version yet

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

• Insecure deserialization

<1.11.4 · fixed in 1.11.4

Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

• Denial of service

>=2.0, <2.14.0 · fixed in 2.14.0

Jenkins exposes multi-line secrets through error messages

• Information disclosure

<2.462.3 || >=2.466, <2.479 · fixed in 2.462.3, 2.479

Jenkins item creation restriction bypass vulnerability

• Memory corruption
• Broken access control

<2.462.3 || >=2.466, <2.479 · fixed in 2.462.3, 2.479

Jenkins OpenId Connect Authentication Plugin lacks issuer claim validation

• Authentication bypass

<4.355.v3a · fixed in 4.355.v3a

Jenkins Credentials plugin reveals encrypted values of credentials to users with Extended Read permission

• Information disclosure
• Hard-coded credentials

>=1372, <1381.v2c3a || <1371.1373.v4eb · fixed in 1381.v2c3a, 1371.1373.v4eb

Jenkins OpenId Connect Authentication Plugin lacks audience claim validation

• Authentication bypass

<4.355.v3a · fixed in 4.355.v3a

Eclipse Glassfish improperly handles http parameters

• Open redirect
• CWE-233

<7.0.17 · fixed in 7.0.17

Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator.

• Insecure deserialization

>=4.4.0, <9.12.0 · fixed in 9.12.0

Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials

• Information disclosure

>=3.2.1, <3.3.0 · fixed in 3.3.0

Apache Hadoop: Temporary File Local Information Disclosure

• Privilege escalation
• CWE-378

<3.4.0 · fixed in 3.4.0

Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability

• Weak cryptography or TLS

<1.6.0 · fixed in 1.6.0

Spring Framework DoS via conditional HTTP request

• Denial of service

<5.3.38 || >=6.0.0, <6.0.23 || >=6.1.0, <6.1.12 · fixed in 5.3.38, 6.0.23, 6.1.12

DataEase has an XML External Entity Reference vulnerability

• XML external entities (XXE)

<2.10.1 · fixed in 2.10.1

DataEase's H2 datasource has a remote command execution risk

• Other injection

<2.10.1 · fixed in 2.10.1

Duplicate Advisory: Keycloak Open Redirect vulnerability

• Open redirect

<25.0.6 · fixed in 25.0.6

Duplicate Advisory: Keycloak SAML signature validation flaw

• Weak cryptography or TLS

<25.0.6 · fixed in 25.0.6

protobuf-java has potential Denial of Service issue

• Denial of service
• Memory corruption

<3.25.5 || >=4.0.0-RC1, <4.27.5 || >=4.28.0-RC1, <4.28.2 · fixed in 3.25.5, 4.27.5, 4.28.2

Gematik Referenzvalidator has an XXE vulnerability that can lead to a Server Side Request Forgery attack

• XML external entities (XXE)

<2.5.1 · fixed in 2.5.1

SOFA Hessian Remote Command Execution (RCE) Vulnerability

• Other injection
• Insecure deserialization

<3.5.5 · fixed in 3.5.5

org.xwiki.platform:xwiki-platform-notifications-ui leaks data of notification filters of users

• Information disclosure

>=13.2-rc-1, <14.10.21 || >=15.0-rc-1, <15.5.5 || >=15.6-rc-1, <15.10.1 · fixed in 14.10.21, 15.5.5, 15.10.1

org.xwiki.platform:xwiki-platform-notifications-ui is missing checks for notification filter preferences editions

• CWE-648

>=13.2-rc-1, <14.10.21 || >=15.0-rc-1, <15.5.5 || >=15.6-rc-1, <15.10.1 · fixed in 14.10.21, 15.5.5, 15.10.1

Keycloak Services has a potential bypass of brute force protection

• Authentication bypass
• CWE-837

<22.0.12 || >=23.0.0, <24.0.7 || >=25.0.0, <25.0.4 · fixed in 22.0.12, 24.0.7, 25.0.4

druid-pac4j, Apache Druid extension, has Padding Oracle vulnerability

• Information disclosure
• Weak cryptography or TLS

>=0.18.0, <30.0.1 · fixed in 30.0.1

Apache Druid: Users can provide MySQL JDBC properties not on allow list

• CWE-20

<30.0.1 · fixed in 30.0.1

hermes-management is vulnerable to RCE due to Apache commons-jxpath

• CWE-1395

>=0.8.2, <2.2.9 · fixed in 2.2.9

OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) allows follower controller to set up flow entries

• Broken access control

<=13.0.1 · no fixed version yet

OpenDaylight Authentication, Authorization and Accounting (AAA) peer impersonation vulnerability

• Broken access control
• Authentication bypass

<=0.19.3 · no fixed version yet

Apache Seata Deserialization of Untrusted Data vulnerability

• Insecure deserialization

>=2.0.0, <2.1.0 || >=1.0.0, <1.8.1 · fixed in 2.1.0, 1.8.1

Path traversal vulnerability in functional web frameworks

• Path traversal

>=6.1.0, <6.1.13 || >=6.0.0, <=6.0.23 || >=5.3.0, <=5.3.39 · fixed in 6.1.13

Eclipse Dataspace Components's ConsumerPullTransferTokenValidationApiController doesn't check for token validit

• Authentication bypass
• CWE-305

>=0.5.0, <0.9.0 · fixed in 0.9.0

Eclipse Glassfish URL redirection vulnerability

• Open redirect

<7.0.10 · fixed in 7.0.10

Keycloak Denial of Service vulnerability

• CWE-231

<24.0.0 · fixed in 24.0.0

XWiki Platform document history including authors of any page exposed to unauthorized actors

• Information disclosure
• Broken access control

>=1.8.0, <15.10.9 || >=16.0.0-rc-1, <16.3.0-rc-1 · fixed in 15.10.9, 16.3.0-rc-1

Keycloak Open Redirect vulnerability

• Open redirect

<24.0.7 · fixed in 24.0.7

Duplicate Advisory: Keycloak Uses a Key Past its Expiration Date

• CWE-324

<24.0.7 · fixed in 24.0.7