Update dependency org.springframework:spring-web to v5 #42
Security Report
❌ New vulnerabilities:
| CVE | Severity |  CVSS Score |
Vulnerable Library | Suggested Fix | Issue | Reachability |
|---|---|---|---|---|---|---|
CVE-2024-38808Path to dependency file: /pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-expression/5.3.38/spring-expression-5.3.38.jar Dependency Hierarchy: -> spring-webmvc-5.3.38.jar (Root Library) -> spring-context-5.3.38.jar -> ❌ spring-expression-5.3.38.jar (Vulnerable Library) |
 Medium |
5.5 | spring-expression-5.3.38.jar | Upgrade to version: org.springframework:spring-expression:5.3.39 | None |
|
CVE-2016-1000027Path to dependency file: /pom.xml Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-web/5.3.38/spring-web-5.3.38.jar Dependency Hierarchy: -> ❌ spring-web-5.3.38.jar (Vulnerable Library) |
 Critical |
9.8 | spring-web-5.3.38.jar | Upgrade to version: org.springframework:spring-web:6.0.0 | None |
|
✔️ Remediated vulnerabilities:
| CVE | Vulnerable Library |
|---|---|
| CVE-2024-22262 | spring-web-4.2.0.RELEASE.jar |
| CVE-2021-22060 | spring-core-4.2.0.RELEASE.jar |
| CVE-2023-20861 | spring-expression-4.2.0.RELEASE.jar |
| CVE-2015-5211 | spring-web-4.2.0.RELEASE.jar |
| CVE-2020-5421 | spring-web-4.2.0.RELEASE.jar |
| CVE-2022-22970 | spring-beans-4.2.0.RELEASE.jar |
| CVE-2024-22259 | spring-web-4.2.0.RELEASE.jar |
| CVE-2021-22096 | spring-web-4.2.0.RELEASE.jar |
| CVE-2022-22968 | spring-context-4.2.0.RELEASE.jar |
| CVE-2022-22950 | spring-expression-4.2.0.RELEASE.jar |
| CVE-2021-22096 | spring-core-4.2.0.RELEASE.jar |
| CVE-2018-15756 | spring-web-4.2.0.RELEASE.jar |
| CVE-2024-38808 | spring-expression-4.2.0.RELEASE.jar |
| CVE-2016-1000027 | spring-web-4.2.0.RELEASE.jar |
| CVE-2016-5007 | spring-webmvc-4.2.0.RELEASE.jar |
| WS-2021-0170 | spring-core-4.2.0.RELEASE.jar |
| CVE-2018-1271 | spring-webmvc-4.2.0.RELEASE.jar |
| WS-2016-7112 | spring-context-4.2.0.RELEASE.jar |
| CVE-2021-22096 | spring-webmvc-4.2.0.RELEASE.jar |
| CVE-2018-1272 | spring-core-4.2.0.RELEASE.jar |
| CVE-2023-20863 | spring-expression-4.2.0.RELEASE.jar |
| CVE-2024-22243 | spring-web-4.2.0.RELEASE.jar |
| CVE-2015-5211 | spring-webmvc-4.2.0.RELEASE.jar |
| CVE-2024-38809 | spring-web-4.2.0.RELEASE.jar |
| CVE-2022-22965 | spring-beans-4.2.0.RELEASE.jar |
| CVE-2016-9878 | spring-webmvc-4.2.0.RELEASE.jar |
| CVE-2018-1199 | spring-core-4.2.0.RELEASE.jar |
| CVE-2022-22970 | spring-core-4.2.0.RELEASE.jar |
Base branch total remaining vulnerabilities: 201
Base branch commit: 643a7fad08d6608eaf25b22f87aee4b43387f2fc
Total libraries scanned: 109
Scan token: 2e9a11e8ba4a48b480fa79d65b047e76