[Snyk] Upgrade commons-fileupload:commons-fileupload from 1.2.1 to 1.5

[karencapiiro]

Snyk has created this PR to upgrade commons-fileupload:commons-fileupload from 1.2.1 to 1.5.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 7 versions ahead of your current version.

• The recommended version was released on 2 years ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Arbitrary File Write SNYK-JAVA-COMMONSFILEUPLOAD-30080	300	No Known Exploit
	Denial of Service (DoS) SNYK-JAVA-COMMONSFILEUPLOAD-30081	300	Mature
	Arbitrary Code Execution SNYK-JAVA-COMMONSFILEUPLOAD-30401	300	No Known Exploit
	Information Exposure SNYK-JAVA-COMMONSFILEUPLOAD-31540	300	No Known Exploit
	Denial of Service (DoS) SNYK-JAVA-COMMONSFILEUPLOAD-3326457	300	No Known Exploit
	Time of Check Time of Use (TOCTOU) SNYK-JAVA-COMMONSFILEUPLOAD-30079	300	No Known Exploit

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
maven/commons-fileupload/commons-fileupload@1.5	eval, filesystem, unsafe	+3	1.09 MB

🚮 Removed packages: maven/commons-fileupload/commons-fileupload@1.2.1

View full report↗︎

[rafikmojr]

Checkmarx One – Scan Summary & Details – 99eee291-046d-4cae-b016-88df4142a3fe

New Issues

Severity	Issue	Source File / Package	Checkmarx Insight
	CVE-2023-26464	Maven-log4j:log4j-1.2.8	Vulnerable Package
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 162	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 162	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 162	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/DefaultLessonAction.java: 133	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/instructor/CrossSiteScripting/FindProfile_i.java: 51	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/CrossSiteScripting/FindProfile.java: 132	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/WsSqlInjection.java: 161	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/GoatHillsFinancial/FindProfile.java: 60	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/SqlStringInjection.java: 203	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/SQLInjection/ViewProfile.java: 192	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/SqlNumericInjection.java: 178	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/SqlStringInjection.java: 203	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/SqlModifyData.java: 166	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/SqlAddData.java: 148	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/SqlNumericInjection.java: 98	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/ThreadSafetyProblem.java: 80	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/BlindNumericSqlInjection.java: 80	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/BlindStringSqlInjection.java: 80	Attack Vector
	Relative_Path_Traversal	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	Attack Vector
	Relative_Path_Traversal	/webgoat/src/main/java/org/owasp/webgoat/lessons/admin/ReportCardScreen.java: 79	Attack Vector

Fixed Issues

Severity	Issue	Source File / Package
	CVE-2013-2186	Maven-commons-fileupload:commons-fileupload-1.2.1
	CVE-2014-0050	Maven-commons-fileupload:commons-fileupload-1.2.1
	CVE-2016-1000031	Maven-commons-fileupload:commons-fileupload-1.2.1
	CVE-2016-3092	Maven-commons-fileupload:commons-fileupload-1.2.1
	CVE-2023-24998	Maven-commons-fileupload:commons-fileupload-1.2.1
	Command_Injection	/webgoat/src/main/java/org/owasp/webgoat/lessons/Challenge2Screen.java: 641
	CSRF	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 615
	CSRF	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 615
	CSRF	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 615
	CSRF	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 615
	CSRF	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597
	CSRF	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597
	CSRF	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597
	Cleartext_Submission_of_Sensitive_Information	/webgoat/src/main/webapp/lessons/SQLInjection/ViewProfile.jsp: 67
	Cleartext_Submission_of_Sensitive_Information	/webgoat/src/main/webapp/lessons/SQLInjection/EditProfile.jsp: 67
	Cleartext_Submission_of_Sensitive_Information	/webgoat/src/main/webapp/lessons/RoleBasedAccessControl/ViewProfile.jsp: 67
	Cleartext_Submission_of_Sensitive_Information	/webgoat/src/main/webapp/lessons/RoleBasedAccessControl/EditProfile.jsp: 66
	Cleartext_Submission_of_Sensitive_Information	/webgoat/src/main/webapp/lessons/GoatHillsFinancial/ViewProfile.jsp: 67
	Cleartext_Submission_of_Sensitive_Information	/webgoat/src/main/webapp/lessons/GoatHillsFinancial/EditProfile.jsp: 66
	Cleartext_Submission_of_Sensitive_Information	/webgoat/src/main/webapp/lessons/DBSQLInjection/ViewProfile.jsp: 67
	Cleartext_Submission_of_Sensitive_Information	/webgoat/src/main/webapp/lessons/DBSQLInjection/EditProfile.jsp: 67
	Cleartext_Submission_of_Sensitive_Information	/webgoat/src/main/webapp/lessons/DBCrossSiteScripting/ViewProfile.jsp: 65
	Cleartext_Submission_of_Sensitive_Information	/webgoat/src/main/webapp/lessons/DBCrossSiteScripting/EditProfile.jsp: 67
	Cleartext_Submission_of_Sensitive_Information	/webgoat/src/main/webapp/lessons/CrossSiteScripting/ViewProfile.jsp: 72
	Cleartext_Submission_of_Sensitive_Information	/webgoat/src/main/webapp/lessons/CrossSiteScripting/EditProfile.jsp: 67
	Cleartext_Submission_of_Sensitive_Information	/webgoat/src/main/webapp/lessons/SQLInjection/ViewProfile.jsp: 41
	Cleartext_Submission_of_Sensitive_Information	/webgoat/src/main/webapp/lessons/SQLInjection/EditProfile.jsp: 41
	Cleartext_Submission_of_Sensitive_Information	/webgoat/src/main/webapp/lessons/RoleBasedAccessControl/ViewProfile.jsp: 41

More results are available on AST platform