Maven Package Vulnerabilities
Vulnerabilities associated with org.jeecgframework.boot:jeecg-boot-base.
Packages
Clear package- org.jenkins-ci.main:jenkins-core257 vulnerabilities
- org.apache.tomcat:tomcat160 vulnerabilities
- com.liferay.portal:release.portal.bom159 vulnerabilities
- com.liferay.portal:release.dxp.bom125 vulnerabilities
- org.keycloak:keycloak-services97 vulnerabilities
- com.fasterxml.jackson.core:jackson-databind80 vulnerabilities
- org.apache.tomcat.embed:tomcat-embed-core74 vulnerabilities
- org.apache.struts:struts2-core60 vulnerabilities
- org.keycloak:keycloak-core50 vulnerabilities
- org.xwiki.platform:xwiki-platform-oldcore46 vulnerabilities
- org.elasticsearch:elasticsearch44 vulnerabilities
- net.mingsoft:ms-mcms39 vulnerabilities
- org.apache.tomcat:tomcat-catalina39 vulnerabilities
- io.undertow:undertow-core38 vulnerabilities
- com.thoughtworks.xstream:xstream37 vulnerabilities
- com.jfinal:jfinal36 vulnerabilities
- org.jenkins-ci.plugins:script-security35 vulnerabilities
- org.apache.solr:solr-core31 vulnerabilities
- org.apache.tomcat:tomcat-coyote31 vulnerabilities
- org.opencms:opencms-core31 vulnerabilities
- org.springframework.security:spring-security-core31 vulnerabilities
- org.eclipse.jetty:jetty-server29 vulnerabilities
- org.bouncycastle:bcprov-jdk1426 vulnerabilities
- org.apache.openmeetings:openmeetings-parent25 vulnerabilities
- org.keycloak:keycloak-parent25 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2021-37305HIGH | Insecure Permissions issue in jeecg-bootAn Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /sys/user/querySysUser?username=admin. | CVSS7.5v3.1 | EPSS3.52% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2021-37306HIGH | Insecure Permissions issue in jeecg-bootAn Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: api uri:/sys/user/checkOnlyUser?username=admin. CWE-732Feb 3, 2023 | CVSS7.5v3.1 | EPSS0.801% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-37304HIGH | Insecure Permissions issue in jeecg-bootAn Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface. | CVSS7.5v3.1 | EPSS4.01% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2021-44585MEDIUM | Cross-site Scripting in jeecg-bootA Cross Site Scripting (XSS) vulnerabilitiy exits in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event. CWE-79Mar 10, 2022 | CVSS6.1v3.1 | EPSS0.907% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-22881CRITICAL | SQL Injection in Jeecg-bootJeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData. CWE-89Feb 16, 2022 | CVSS9.8v3.1 | EPSS1.37% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-22880CRITICAL | SQL Injection in Jeecg-bootJeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId. CWE-89Feb 16, 2022 | CVSS9.8v3.1 | EPSS1.37% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-46089CRITICAL | SQL Injection in JeecgBootIn JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges. CWE-89Jan 25, 2022 | CVSS9.8v3.1 | EPSS2% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |