You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
XPath_Injection issue exists @ src/main/java/org/cysecurity/cspf/jvl/controller/XPathQuery.java in branch master
The application's processRequest method constructs an XPath query, for navigating an XML document. The XPath query is created with compile, at line 30 of src\main\java\org\cysecurity\cspf\jvl\controller\XPathQuery.java, using an untrusted string embedded in the expression.
This may enable an attacker to modify the XPath expression, leading to an XPath Injection attack.
The attacker may be able to inject the modified XPath expression via user input, ""username"", which is retrieved by the application in the processRequest method, at line 30 of src\main\java\org\cysecurity\cspf\jvl\controller\XPathQuery.java. This value then flows through the code to compile, as noted.
XPath_Injection issue exists @ src/main/java/org/cysecurity/cspf/jvl/controller/XPathQuery.java in branch master
The application's processRequest method constructs an XPath query, for navigating an XML document. The XPath query is created with compile, at line 30 of src\main\java\org\cysecurity\cspf\jvl\controller\XPathQuery.java, using an untrusted string embedded in the expression.
This may enable an attacker to modify the XPath expression, leading to an XPath Injection attack.
The attacker may be able to inject the modified XPath expression via user input, ""username"", which is retrieved by the application in the processRequest method, at line 30 of src\main\java\org\cysecurity\cspf\jvl\controller\XPathQuery.java. This value then flows through the code to compile, as noted.
Severity: High
CWE:643
Vulnerability details and guidance
Internal Guidance
Checkmarx
Lines: 35 36
Code (Line #35):
Code (Line #36):
The text was updated successfully, but these errors were encountered: