story #15455 feat: upgrade CAS 6 to 7

[Regzox]

No description provided.

[vitam-prg]

Checkmarx One – Scan Summary & Details – 127c6bb9-f8cc-49dd-9d4a-7dad1a1e7575

New Issues (110)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CVE-2024-57699	Maven-net.minidev:json-smart-2.5.1	details Recommended version: 2.5.2 Description: A security issue was found in Netplex Json-smart. When loading a specially crafted JSON input, containing a large number of "{", a stack exhaustion... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
2		CVE-2022-22970	Maven-org.springframework:spring-beans-5.3.18	details Recommended version: 5.3.31-wso2v1 Description: In Spring Framework versions 5.2.0 through 5.2.21, 5.3.0 through 5.3.19, and older unsupported versions, applications that handle file uploads are ... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
3		CVE-2024-12798	Maven-ch.qos.logback:logback-classic-1.4.14	details Recommended version: 1.5.13 Description: Arbitrary Code Execution vulnerability in "JaninoEventEvaluator" by QOS.CH logback in Java applications, allows attackers to execute arbitrary code... Attack Vector: LOCAL Attack Complexity: LOW Vulnerable Package
4		CVE-2024-12798	Maven-ch.qos.logback:logback-core-1.4.14	details Recommended version: 1.5.19 Description: Arbitrary Code Execution vulnerability in "JaninoEventEvaluator" by QOS.CH logback in Java applications, allows attackers to execute arbitrary code... Attack Vector: LOCAL Attack Complexity: LOW Vulnerable Package
5		Privacy_Violation	/api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 85	details Method getTenantIdentifier at line 85 of /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java sends... Attack Vector
6		Privacy_Violation	/api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 175	details Method getApplicationId at line 175 of /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java sends u... Attack Vector
7		Privacy_Violation	/api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 85	details Method getTenantIdentifier at line 85 of /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java sends... Attack Vector
8		Privacy_Violation	/api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 85	details Method getTenantIdentifier at line 85 of /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java sends... Attack Vector
9		Privacy_Violation	/api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 85	details Method getTenantIdentifier at line 85 of /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java sends... Attack Vector
10		Privacy_Violation	/api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 175	details Method getApplicationId at line 175 of /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java sends u... Attack Vector
11		Privacy_Violation	/api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 175	details Method getApplicationId at line 175 of /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java sends u... Attack Vector
12		Privacy_Violation	/api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java: 175	details Method getApplicationId at line 175 of /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/SecurityService.java sends u... Attack Vector
13		Use_Of_Hardcoded_Password	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/passwordless/CustomPasswordlessUserAccountStore.java: 68	details The application uses the hard-coded password CUSTOM_PASSWORDLESS_ERROR for authentication purposes, either using it to verify users' identities,... Attack Vector
14		CVE-2024-12801	Maven-ch.qos.logback:logback-core-1.4.14	details Recommended version: 1.5.19 Description: Server-Side Request Forgery (SSRF) in "SaxEventRecorder" by QOS.CH logback on the Java platform, allows an attacker to forge requests by compromisi... Attack Vector: LOCAL Attack Complexity: LOW Vulnerable Package
15		Heap_Inspection	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/webflow/actions/I18NSendPasswordResetInstructionsAction.java: 217	details Method buildPasswordManagementQuery at line 217 of /cas/cas-server/src/main/java/fr/gouv/vitamui/cas/webflow/actions/I18NSendPasswordResetInstruct... Attack Vector
16		Heap_Inspection	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/password/IamPasswordManagementService.java: 168	details Method changeInternal at line 168 of /cas/cas-server/src/main/java/fr/gouv/vitamui/cas/password/IamPasswordManagementService.java defines confirm... Attack Vector
17		Heap_Inspection	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/password/IamPasswordManagementService.java: 167	details Method changeInternal at line 167 of /cas/cas-server/src/main/java/fr/gouv/vitamui/cas/password/IamPasswordManagementService.java defines passwor... Attack Vector
18		Heap_Inspection	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/webflow/actions/TriggerChangePasswordAction.java: 69	details Method doExecute at line 69 of /cas/cas-server/src/main/java/fr/gouv/vitamui/cas/webflow/actions/TriggerChangePasswordAction.java defines doChang... Attack Vector
19		Log_Forging	/api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 215	details Method streamingUploadSip at line 215 of /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java gets u... Attack Vector
20		Log_Forging	/api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 214	details Method streamingUploadSip at line 214 of /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java gets u... Attack Vector
21		Log_Forging	/api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 215	details Method streamingUploadSip at line 215 of /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java gets u... Attack Vector
22		Log_Forging	/api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java: 215	details Method streamingUploadSip at line 215 of /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/ProjectController.java gets u... Attack Vector
23		Log_Forging	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/util/Utils.java: 188	details Method getIdpValue at line 188 of /cas/cas-server/src/main/java/fr/gouv/vitamui/cas/util/Utils.java gets user input from element IDP_PARAMETER.... Attack Vector
24		Log_Forging	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/web/CustomCorsProcessor.java: 162	details Method getHeadersToUse at line 162 of /cas/cas-server/src/main/java/fr/gouv/vitamui/cas/web/CustomCorsProcessor.java gets user input from element... Attack Vector
25		Log_Forging	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/web/CustomCorsProcessor.java: 158	details Method getMethodToUse at line 158 of /cas/cas-server/src/main/java/fr/gouv/vitamui/cas/web/CustomCorsProcessor.java gets user input from element ... Attack Vector
26		Log_Forging	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/authentication/LoginPwdAuthenticationHandler.java: 195	details Method extractClientIp at line 195 of /cas/cas-server/src/main/java/fr/gouv/vitamui/cas/authentication/LoginPwdAuthenticationHandler.java gets us... Attack Vector
27		Log_Forging	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/web/CustomCorsProcessor.java: 56	details Method handleInternal at line 56 of /cas/cas-server/src/main/java/fr/gouv/vitamui/cas/web/CustomCorsProcessor.java gets user input from element g... Attack Vector
28		Log_Forging	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/web/CustomCorsProcessor.java: 56	details Method handleInternal at line 56 of /cas/cas-server/src/main/java/fr/gouv/vitamui/cas/web/CustomCorsProcessor.java gets user input from element g... Attack Vector
29		Log_Forging	/api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/TransactionController.java: 199	details Method downloadSipTransaction at line 199 of /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/TransactionController.jav... Attack Vector
30		Log_Forging	/api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/TransactionController.java: 199	details Method downloadSipTransaction at line 199 of /api/api-collect/collect/src/main/java/fr/gouv/vitamui/collect/server/rest/TransactionController.jav... Attack Vector

More results are available on the CxOne platform

Fixed Issues (64)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CVE-2022-1471	Maven-org.yaml:snakeyaml-1.31
	CVE-2022-31692	Maven-org.springframework.security:spring-security-core-5.7.3
	CVE-2023-20873	Maven-org.springframework.boot:spring-boot-actuator-autoconfigure-2.7.3
	CVE-2023-34034	Maven-org.springframework.security:spring-security-config-5.7.3
	CVE-2023-34034	Maven-org.springframework.security:spring-security-web-5.7.3
	CVE-2024-38821	Maven-org.springframework.security:spring-security-web-5.7.3
	CVE-2022-31690	Maven-org.springframework.security:spring-security-web-5.7.3
	CVE-2022-40152	Maven-com.fasterxml.woodstox:woodstox-core-6.2.6
	CVE-2022-42003	Maven-com.fasterxml.jackson.core:jackson-databind-2.13.4
	CVE-2022-45688	Maven-org.json:json-20160810
	CVE-2022-45689	Maven-org.json:json-20160810
	CVE-2022-45690	Maven-org.json:json-20160810
	CVE-2023-1370	Maven-net.minidev:json-smart-2.4.8
	CVE-2023-2976	Maven-com.google.guava:guava-30.1.1-jre
	CVE-2023-31582	Maven-org.bitbucket.b_c:jose4j-0.8.0
	CVE-2023-33265	Maven-com.hazelcast:hazelcast-5.1.3
	CVE-2023-34620	Maven-org.hjson:hjson-3.0.0
	CVE-2023-38286	Maven-org.thymeleaf:thymeleaf-3.0.15.RELEASE
	CVE-2023-39685	Maven-org.hjson:hjson-3.0.0
	CVE-2023-45859	Maven-com.hazelcast:hazelcast-5.1.3
	CVE-2023-45860	Maven-com.hazelcast:hazelcast-sql-5.1.3
	CVE-2023-45860	Maven-com.hazelcast:hazelcast-5.1.3
	CVE-2023-46120	Maven-com.rabbitmq:amqp-client-5.15.0
	CVE-2023-5072	Maven-org.json:json-20160810
	CVE-2023-51775	Maven-org.bitbucket.b_c:jose4j-0.8.0
	CVE-2023-52428	Maven-com.nimbusds:nimbus-jose-jwt-9.24.3
	CVE-2024-21634	Maven-software.amazon.ion:ion-java-1.0.2
	CVE-2024-22257	Maven-org.springframework.security:spring-security-core-5.7.3
	CVE-2024-29371	Maven-org.bitbucket.b_c:jose4j-0.8.0
	CVE-2025-22235	Maven-org.springframework.boot:spring-boot-actuator-autoconfigure-2.7.3
	CVE-2025-48734	Maven-commons-beanutils:commons-beanutils-1.9.4
	CVE-2025-52999	Maven-com.fasterxml.jackson.core:jackson-core-2.13.4
	Cx08fcacc9-cb99	Maven-org.json:json-20160810
	Cx2906ba70-607a	Maven-org.json:json-20160810
	Cx78f40514-81ff	Maven-commons-collections:commons-collections-3.2.2
	Cx8bc13cba-30bf	Maven-org.bitbucket.b_c:jose4j-0.8.0
	Cxdb5a1032-eda2	Maven-org.json:json-20160810
	CVE-2021-28170	Maven-org.glassfish.web:el-impl-2.2
	CVE-2022-22976	Maven-org.springframework.security:spring-security-crypto-5.6.1
	CVE-2022-38752	Maven-org.yaml:snakeyaml-1.31
	CVE-2022-41854	Maven-org.yaml:snakeyaml-1.31
	CVE-2023-20861	Maven-org.springframework:spring-expression-5.3.22
	CVE-2023-20862	Maven-org.springframework.security:spring-security-web-5.7.3
	CVE-2023-20862	Maven-org.springframework.security:spring-security-config-5.7.3
	CVE-2023-20863	Maven-org.springframework:spring-expression-5.3.22
	CVE-2023-33264	Maven-com.hazelcast:hazelcast-5.1.3
	CVE-2023-34055	Maven-org.springframework.boot:spring-boot-actuator-2.7.3
	CVE-2023-34462	Maven-io.netty:netty-handler-4.1.80.Final
	CVE-2023-44483	Maven-org.apache.santuario:xmlsec-2.3.0
	CVE-2024-38808	Maven-org.springframework:spring-expression-5.3.22
	CVE-2024-47535	Maven-io.netty:netty-common-4.1.80.Final
	Privacy_Violation	/api/api-iam/iam-client-legacy/src/main/java/fr/gouv/vitamui/iam/client/CasRestClient.java: 193
	Privacy_Violation	/api/api-iam/iam-client-legacy/src/main/java/fr/gouv/vitamui/iam/client/CasRestClient.java: 153
	Privacy_Violation	/api/api-iam/iam-client-legacy/src/main/java/fr/gouv/vitamui/iam/client/CasRestClient.java: 153
	Privacy_Violation	/api/api-iam/iam-client-legacy/src/main/java/fr/gouv/vitamui/iam/client/CasRestClient.java: 153
	Privacy_Violation	/api/api-iam/iam-client-legacy/src/main/java/fr/gouv/vitamui/iam/client/CasRestClient.java: 153
	Privacy_Violation	/api/api-iam/iam-client-legacy/src/main/java/fr/gouv/vitamui/iam/client/CasRestClient.java: 153
	Privacy_Violation	/api/api-iam/iam-client-legacy/src/main/java/fr/gouv/vitamui/iam/client/CasRestClient.java: 153
	Privacy_Violation	/api/api-iam/iam-commons/src/main/java/fr/gouv/vitamui/iam/common/utils/Pac4jClientBuilder.java: 105
	Privacy_Violation	/api/api-iam/iam-commons/src/main/java/fr/gouv/vitamui/iam/common/utils/Pac4jClientBuilder.java: 106
	Privacy_Violation	/api/api-iam/iam-commons/src/main/java/fr/gouv/vitamui/iam/common/utils/Pac4jClientBuilder.java: 88
	CVE-2020-8908	Maven-com.google.guava:guava-30.1.1-jre
	Heap_Inspection	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/webflow/actions/TriggerChangePasswordAction.java: 72
	Heap_Inspection	/cas/cas-server/src/main/java/fr/gouv/vitamui/cas/webflow/actions/I18NSendPasswordResetInstructionsAction.java: 197

---

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR