mybatis-3.1.1.jar: 1 vulnerabilities (highest severity is: 8.1)

[mend-for-github-com]

Vulnerable Library - mybatis-3.1.1.jar

The MyBatis data mapper framework makes it easier to use a relational database with object-oriented applications. MyBatis couples objects with stored procedures or SQL statements using a XML descriptor or annotations. Simplicity is the biggest advantage of the MyBatis data mapper over object relational mapping tools.

Library home page: http://www.mybatis.org/core/

Path to dependency file: /ksa-dao-context/pom.xml

Path to vulnerable library: /itory/org/mybatis/mybatis/3.1.1/mybatis-3.1.1.jar

Found in HEAD commit: 6ff98937d8108e10b02d7d74ad01cac70cd3d78e

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2020-26945	High	8.1	mybatis-3.1.1.jar	Direct	3.5.6	✅

Details

CVE-2020-26945

Vulnerable Library - mybatis-3.1.1.jar

The MyBatis data mapper framework makes it easier to use a relational database with object-oriented applications. MyBatis couples objects with stored procedures or SQL statements using a XML descriptor or annotations. Simplicity is the biggest advantage of the MyBatis data mapper over object relational mapping tools.

Library home page: http://www.mybatis.org/core/

Path to dependency file: /ksa-dao-context/pom.xml

Path to vulnerable library: /itory/org/mybatis/mybatis/3.1.1/mybatis-3.1.1.jar

Dependency Hierarchy:

• ❌ mybatis-3.1.1.jar (Vulnerable Library)

Found in HEAD commit: 6ff98937d8108e10b02d7d74ad01cac70cd3d78e

Found in base branch: master

Vulnerability Details

MyBatis before 3.5.6 mishandles deserialization of object streams.

Publish Date: 2020-10-10

URL: CVE-2020-26945

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-10-26

Fix Resolution: 3.5.6

⛑️ Automatic Remediation is available for this issue

---

⛑️ Automatic Remediation is available for this issue.