CVE-2014-9515 (Critical) detected in dozer-core-6.5.0.jar, dozer-core-6.5.0-jar-with-dependencies.jar

[mend-bolt-for-github]

CVE-2014-9515 - Critical Severity Vulnerability

Vulnerable Libraries - dozer-core-6.5.0.jar, dozer-core-6.5.0-jar-with-dependencies.jar

dozer-core-6.5.0.jar

Dozer is a powerful Java Bean to Java Bean mapper that recursively copies data from one object to another

Library home page: http://nexus.sonatype.org/oss-repository-hosting.html/dozer-parent/dozer-plugins-parent/dozer-core

Path to dependency file: /modules/objectmappers-benchmarks/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/github/dozermapper/dozer-core/6.5.0/dozer-core-6.5.0.jar,/github/dozermapper/dozer-core/6.5.0/dozer-core-6.5.0.jar

Dependency Hierarchy:

• ❌ dozer-core-6.5.0.jar (Vulnerable Library)

dozer-core-6.5.0-jar-with-dependencies.jar

Path to dependency file: /modules/objectmappers-dozer/pom.xml

Path to vulnerable library: /loadResource_XJGMSE/20221019101539/dozer-core-6.5.0.jar

Dependency Hierarchy:

• ❌ dozer-core-6.5.0-jar-with-dependencies.jar (Vulnerable Library)

Found in HEAD commit: ccc3fe199db8575ce11d67be41855d33c5e718ab

Found in base branch: master

Vulnerability Details

Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized object.

Publish Date: 2017-12-29

URL: CVE-2014-9515

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with Mend here

[github-actions]

Thank you for opening an issue. If this issue is related to a bug, please follow the steps and provide the information outlined in the Troubleshooting Guide. Failure to follow these instructions may result in automatic closing of this issue.