René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Dependency org.apache.shiro:shiro-web, leading to CVE problem","articleBody":"Hi, In **javaee-tutorial**，there is a dependency **org.apache.shiro:shiro-web:1.2.4** that calls the risk method.\r\n\r\n[CVE-2020-11989](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11989)\r\n\r\nThe scope of this CVE affected version is **[,1.5.3)**\r\n\r\nAfter further analysis, in this project, the main Api called is **\u003corg.apache.shiro.web.util.WebUtils: java.lang.String getPathWithinApplication(javax.servlet.http.HttpServletRequest)\u003e**\r\n\r\nRisk method repair link : [GitHub](https://github.com/apache/shiro/commit/b90f91875e5e18c4805013c2fa0567b1700f5a96)\r\n\r\n**CVE Bug Invocation Path--**\r\n\r\n**Path Length : 3**\r\n\r\n```\r\n\u003corg.apache.shiro.web.util.WebUtils: java.lang.String getPathWithinApplication(javax.servlet.http.HttpServletRequest)\u003e\r\nat \u003ccom.giit.www.filter.FormLoginFilter: boolean isLoginRequest(javax.servlet.http.HttpServletRequest)\u003e (com.giit.www.filter.FormLoginFilter.java:[60]) in /detect/unzip/javaee-tutorial-master/target/classes\r\nat \u003ccom.giit.www.filter.FormLoginFilter: boolean onPreHandle(javax.servlet.ServletRequest,javax.servlet.ServletResponse,java.lang.Object)\u003e (com.giit.www.filter.FormLoginFilter.java:[26]) in /detect/unzip/javaee-tutorial-master/target/classes\r\n```\r\n\r\n\r\n\r\n**Dependency tree--**\r\n\r\n```\r\n[INFO] core:com.giit.www.orderbook:war:1.0-SNAPSHOT\r\n[INFO] +- org.hamcrest:hamcrest-core:jar:1.3:compile\r\n[INFO] +- org.apache.shiro:shiro-core:jar:1.4.2:compile\r\n[INFO] |  +- org.apache.shiro:shiro-lang:jar:1.4.2:compile\r\n[INFO] |  +- org.apache.shiro:shiro-cache:jar:1.4.2:compile\r\n[INFO] |  +- org.apache.shiro:shiro-crypto-hash:jar:1.4.2:compile\r\n[INFO] |  |  \\- org.apache.shiro:shiro-crypto-core:jar:1.4.2:compile\r\n[INFO] |  +- org.apache.shiro:shiro-crypto-cipher:jar:1.4.2:compile\r\n[INFO] |  +- org.apache.shiro:shiro-config-core:jar:1.4.2:compile\r\n[INFO] |  +- org.apache.shiro:shiro-config-ogdl:jar:1.4.2:compile\r\n[INFO] |  |  \\- commons-beanutils:commons-beanutils:jar:1.9.3:compile\r\n[INFO] |  |     \\- commons-collections:commons-collections:jar:3.2.2:compile\r\n[INFO] |  \\- org.apache.shiro:shiro-event:jar:1.4.2:compile\r\n[INFO] +- org.apache.shiro:shiro-web:jar:1.2.4:compile\r\n[INFO] +- org.apache.shiro:shiro-quartz:jar:1.2.4:compile\r\n[INFO] |  \\- org.opensymphony.quartz:quartz:jar:1.6.1:compile\r\n[INFO] +- org.apache.shiro:shiro-spring:jar:1.2.4:compile\r\n[INFO] +- org.apache.shiro:shiro-aspectj:jar:1.2.4:compile\r\n[INFO] +- mysql:mysql-connector-java:jar:5.1.38:compile\r\n[INFO] +- org.aspectj:aspectjrt:jar:1.8.8:compile\r\n[INFO] +- org.aspectj:aspectjweaver:jar:1.8.8:compile\r\n[INFO] |  \\- org.springframework:spring-core:jar:4.2.4.RELEASE:compile\r\n[INFO] +- org.springframework:spring-context-support:jar:4.2.4.RELEASE:compile\r\n[INFO] |  +- org.springframework:spring-beans:jar:4.2.4.RELEASE:compile\r\n[INFO] |  \\- org.springframework:spring-context:jar:4.2.4.RELEASE:compile\r\n[INFO] |     \\- org.springframework:spring-aop:jar:4.2.4.RELEASE:compile\r\n[INFO] |        \\- aopalliance:aopalliance:jar:1.0:compile\r\n[INFO] +- org.springframework:spring-jdbc:jar:4.2.4.RELEASE:compile\r\n[INFO] +- org.springframework:spring-tx:jar:4.2.4.RELEASE:compile\r\n[INFO] +- org.springframework:spring-webmvc:jar:4.2.4.RELEASE:compile\r\n[INFO] |  +- org.springframework:spring-expression:jar:4.2.4.RELEASE:compile\r\n[INFO] |  \\- org.springframework:spring-web:jar:4.2.4.RELEASE:compile\r\n[INFO] +- javax.servlet:javax.servlet-api:jar:3.0.1:provided\r\n[INFO] +- javax.servlet.jsp:jsp-api:jar:2.2:compile\r\n[INFO] +- javax.servlet:jstl:jar:1.2:compile\r\n[INFO] +- org.mybatis:mybatis-spring:jar:1.2.4:compile\r\n[INFO] +- org.mybatis:mybatis:jar:3.3.1:compile\r\n[INFO] +- cglib:cglib:jar:3.2.0:compile\r\n[INFO] |  +- org.ow2.asm:asm:jar:5.0.3:compile\r\n[INFO] |  \\- org.apache.ant:ant:jar:1.9.4:compile\r\n[INFO] |     \\- org.apache.ant:ant-launcher:jar:1.9.4:compile\r\n[INFO] +- commons-logging:commons-logging:jar:1.2:compile\r\n[INFO] +- org.slf4j:slf4j-api:jar:1.7.14:compile\r\n[INFO] +- log4j:log4j:jar:1.2.17:compile\r\n[INFO] +- org.apache.logging.log4j:log4j-core:jar:2.3:compile\r\n[INFO] |  \\- org.apache.logging.log4j:log4j-api:jar:2.3:compile\r\n[INFO] +- org.slf4j:slf4j-log4j12:jar:1.7.14:compile\r\n[INFO] +- ognl:ognl:jar:3.1.2:compile\r\n[INFO] |  \\- javassist:javassist:jar:3.11.0.GA:compile\r\n[INFO] +- org.javassist:javassist:jar:3.20.0-GA:compile\r\n[INFO] +- org.apache.commons:commons-pool2:jar:2.3:compile\r\n[INFO] +- org.apache.commons:commons-dbcp2:jar:2.1:compile\r\n[INFO] +- com.google.code.gson:gson:jar:2.6:compile\r\n[INFO] \\- commons-fileupload:commons-fileupload:jar:1.3.3:compile\r\n[INFO]    \\- commons-io:commons-io:jar:2.2:compile\r\n```\r\n\r\n**_Suggested solutions:_**\r\n\r\nUpdate dependency version\r\n\r\n\r\n\r\nThank you very much.","author":{"url":"https://github.com/CVEDetect","@type":"Person","name":"CVEDetect"},"datePublished":"2021-09-13T07:30:17.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/13/javaee-tutorial/issues/13"}