[Apiiro] SCA OSS Vulnerabilities - Critical CVSS score · Critical Risk

[haimlebo]

@@@

Discovered on: Oct 14, 2024 09:05
Due date: Oct 18, 2024 09:05
Dependency: org.quartz-scheduler:quartz
Version: 2.2.0
Type: Sub dependency
Introduced through:

• org.broadleafcommerce:broadleaf-profile: 4.0.0-GA > org.broadleafcommerce:broadleaf-common: 4.0.0-GA > org.quartz-scheduler:quartz: 2.2.0

Vulnerabilities

• Code Injection Vulnerability in quartz-jobs 2.3.2 and Below with CVSS score 9.8. fixed version: 2.4.0
• XML external entity injection in Terracotta Quartz Scheduler with CVSS score 9.8. fixed version: 2.3.2

About this package:

External dependency: org.quartz-scheduler:quartz - https://www.quartz-scheduler.org/
Package details: Quartz Enterprise Job Scheduler
Latest version: 2.5.0-rc1
License: Apache-2.0
Insights:

• Single maintainer - This package is maintained by a single developer
• Has vulnerabilities - One or more vulnerabilities have been reported for this package

Remediation

org.quartz-scheduler:quartz is a sub-dependency referenced by the following top-level dependencies:

• org.broadleafcommerce:broadleaf-profile declared in core/broadleaf-profile-web/pom.xml
  Upgrade these top-level dependencies to a version that uses org.quartz-scheduler:quartz with version 2.4.0
  View in Apiiro