[Snyk] Security upgrade org.apache.tomcat:tomcat-catalina from 7.0.27 to 9.0.109

[karencapiiro]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• webgoat/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Relative Path Traversal SNYK-JAVA-ORGAPACHETOMCAT-13734146	222	org.apache.tomcat:tomcat-catalina: 7.0.27 -> 9.0.109 Major version upgrade No Known Exploit

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Relative Path Traversal

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	org.apache.tomcat/​tomcat-catalina@​7.0.27 ⏵ 9.0.109		+75

View full report

[rafikmojr]

Checkmarx One – Scan Summary & Details – e711ae88-a866-48aa-8a68-9b15a55b04b9

New Issues (107)

Checkmarx found the following issues in this Pull Request

Severity	Issue	Source File / Package	Checkmarx Insight
	CVE-2023-40743	Maven-axis:axis-1.2	details Description: When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allo... Attack Vector: NETWORK Attack Complexity: LOW ID: NwmJT9PQl1a7qDpkFu7Hf9BAiOZbF960ONqn%2FKvYzMY%3D Vulnerable Package
	CVE-2019-0227	Maven-axis:axis-1.2	details Description: A Server-Side Request Forgery (SSRF) vulnerability affected the Apache Axis distribution. Security and bug commits continue in the projects Axis 1.... Attack Vector: ADJACENT_NETWORK Attack Complexity: HIGH ID: u55%2FfpmMkRUAGpkt81rFsZzxKiyON86rrzD%2FT1t3Zuw%3D Vulnerable Package
	CVE-2023-26464	Maven-log4j:log4j-1.2.8	details Recommended version: 1.2.17.redhat-00008 Description: When using the Chainsaw or SocketAppender components with Log4j versions 1.0.4 prior to 2.0, an attacker that manages to cause a logging entry invo... Attack Vector: NETWORK Attack Complexity: LOW ID: bGIGso%2Bq4qXhFu3Ayqj6k1syqbIZSrnv5TrQn861YjA%3D Vulnerable Package
	CVE-2023-51441	Maven-axis:axis-1.2	details Description: Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible Server Side Request Forge... Attack Vector: NETWORK Attack Complexity: LOW ID: kObGF80vab1BQHqggj3RdAEVN5v1%2F24Y%2B8KH0sQz26M%3D Vulnerable Package
	CVE-2025-48734	Maven-commons-beanutils:commons-beanutils-1.6	details Recommended version: 1.11.0 Description: An Improper Access Control vulnerability exists in Apache Commons. A special "BeanIntrospector" class was added in version 1.9.2. This can be used ... Attack Vector: NETWORK Attack Complexity: LOW ID: 1BzIbRULU%2BcTEkGV%2BMi0DjT5QvuC%2BTPfqOIl%2Fu9euF0%3D Vulnerable Package
	CVE-2025-48976	Maven-commons-fileupload:commons-fileupload-1.2.1	details Recommended version: 1.6.0 Description: Allocation of resources for multipart headers with insufficient limits enabled a Denial of Service (DoS) vulnerability in Apache Commons FileUpload... Attack Vector: NETWORK Attack Complexity: LOW ID: ioT5qsS6Vh7nPtBrg1p5ScxMPbmxapp%2FBGSeGr324Ao%3D Vulnerable Package
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.java: 183	details The method embeds untrusted data in generated output with addElement, at line 278 of /webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.ja... ID: wl6yAIL4sP48tsJL%2FV7J%2BfbH8vs%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.java: 183	details The method embeds untrusted data in generated output with addElement, at line 258 of /webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.ja... ID: wyf4gmnj%2BLN7y7dTwW32VDSg6aw%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.java: 183	details The method embeds untrusted data in generated output with addElement, at line 254 of /webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.ja... ID: lOgkzAM3u7uojzWbUP9oJ8MjP18%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.java: 183	details The method embeds untrusted data in generated output with addElement, at line 250 of /webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.ja... ID: LaPtoXIMoWqx5PfbYWI6eEh7HqU%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.java: 183	details The method embeds untrusted data in generated output with addElement, at line 274 of /webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.ja... ID: iNfiAUTH1PAeap0FGGjVqj3%2Fg3I%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.java: 183	details The method embeds untrusted data in generated output with addElement, at line 617 of /webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.ja... ID: CIFUcgkC1qiL54%2FQWjaT9mu42EQ%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 615	details The method embeds untrusted data in generated output with addElement, at line 138 of /webgoat/src/main/java/org/owasp/webgoat/lessons/Phishing.ja... ID: piEwUiV962mqeuED3XVPid7c754%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597	details The method embeds untrusted data in generated output with addElement, at line 247 of /webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.ja... ID: eQEiUM6Gu1uYm%2B5nnHuFTWx1RBY%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597	details The method embeds untrusted data in generated output with addElement, at line 243 of /webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.ja... ID: Er%2Bc74fpJODtSQfl%2BAQ3TV5RaMc%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597	details The method embeds untrusted data in generated output with addElement, at line 282 of /webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.ja... ID: bGcUlSe1hQUOCgDXlT56rm5tTH8%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597	details The method embeds untrusted data in generated output with addElement, at line 277 of /webgoat/src/main/java/org/owasp/webgoat/lessons/UncheckedEma... ID: UzqwPgL0D2rZyg8LQQxGY4Nd6TA%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597	details The method embeds untrusted data in generated output with addElement, at line 270 of /webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.ja... ID: 5Yt%2FPMiKvH1j3gRYa5Za8xdVCxE%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597	details The method embeds untrusted data in generated output with addElement, at line 266 of /webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.ja... ID: U5eYoLttN3aF7WNOzZOcq4fo2gU%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597	details The method embeds untrusted data in generated output with addElement, at line 142 of /webgoat/src/main/java/org/owasp/webgoat/lessons/Phishing.ja... ID: t6XhxAMfnsXq%2FriIVAXF0giTE3o%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597	details The method embeds untrusted data in generated output with print, at line 89 of /webgoat/src/main/java/org/owasp/webgoat/lessons/SilentTransactions... ID: lW5%2BWakRPqv9%2ByPlnSNC25D%2BGq8%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597	details The method embeds untrusted data in generated output with StringElement, at line 128 of /webgoat/src/main/java/org/owasp/webgoat/lessons/CommandIn... ID: gdgB9XkW02fzr3lUlnZlrsweMQw%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597	details The method embeds untrusted data in generated output with addElement, at line 195 of /webgoat/src/main/java/org/owasp/webgoat/lessons/UncheckedEma... ID: 5RHJRptXImyzQFRFWpRQl2rEvtU%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597	details The method embeds untrusted data in generated output with PRE, at line 109 of /webgoat/src/main/java/org/owasp/webgoat/lessons/SqlNumericInjection... ID: mbHn7j6HHY4F1kk9mhSeYPiWjO0%3D Attack Vector
	Reflected_XSS	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597	details The method embeds untrusted data in generated output with addElement, at line 195 of /webgoat/src/main/java/org/owasp/webgoat/lessons/Encoding.ja... ID: hM1qoRg9nclNy0xlc2Mznt%2FQBSY%3D Attack Vector
	Relative_Path_Traversal	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 853	details Method at line 853 of /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java gets dynamic data from the getRawParameter element. This ... ID: W5qruXotzvrncOCPutlJK4BJsBo%3D Attack Vector
	Relative_Path_Traversal	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 853	details Method at line 853 of /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java gets dynamic data from the getRawParameter element. This ... ID: 51ydgwjzdhnDtmFnZcHPPiyz3lI%3D Attack Vector
	Relative_Path_Traversal	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 853	details Method at line 853 of /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java gets dynamic data from the getRawParameter element. This ... ID: iM%2BVqnKBSCJGCiYQxCTZ8acMsgI%3D Attack Vector
	Relative_Path_Traversal	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	details Method at line 816 of /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java gets dynamic data from the getRequest element. This eleme... ID: 0wQV3Jos9kQnCQwpPzacNdzBHiM%3D Attack Vector
	Relative_Path_Traversal	/webgoat/src/main/java/org/owasp/webgoat/lessons/admin/ReportCardScreen.java: 79	details Method at line 79 of /webgoat/src/main/java/org/owasp/webgoat/lessons/admin/ReportCardScreen.java gets dynamic data from the getRawParameter elem... ID: 6kmeH%2Fp%2F90lx0ZVcr8OmdNhUeOw%3D Attack Vector
	CVE-2021-29425	Maven-commons-io:commons-io-1.4	details Recommended version: 2.11.0.redhat-00004 Description: In Commons IO versions 1.1 through 2.6, when invoking the method "FileNameUtils.normalize" with an improper input string, like "//../foo", or "\\..... Attack Vector: NETWORK Attack Complexity: HIGH ID: IYDaXqueuaW8EmqVQNdOF1410VjDm4nyQ3xC7SMY6tM%3D Vulnerable Package
	Hardcoded_password_in_Connection_String	/webgoat/src/main/java/org/owasp/webgoat/session/WebgoatContext.java: 19	details The application contains hardcoded connection details, ""DatabasePassword"", at line 19 of /webgoat/src/main/java/org/owasp/webgoat/session/Webgoat... ID: C9la4gLAFKbohvS6H7dCkmo1qB4%3D Attack Vector
	Missing_HSTS_Header	/webgoat/src/main/webapp/lessons/Ajax/clientSideFiltering.jsp: 1	details The web-application does not define an HSTS header, leaving it vulnerable to attack. ID: 7z270s61NZFtvXTaMZwaYn%2BGUJw%3D Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816	details Method at line 816 of /webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java gets user input from element getRequest. This input is la... ID: 6dLwpxSgG%2BF%2FDke4wUDh6DU4hqw%3D Attack Vector
	Parameter_Tampering	/webgoat/src/main/java/org/owasp/webgoat/lessons/BlindStringSqlInjection.java: 80	details Method at line 80 of /webgoat/src/main/java/org/owasp/webgoat/lessons/BlindStringSqlInjection.java gets user input from element getRawParameter.... ID: aIIgzhnNW0hDFo6FzdYqUXmmfOQ%3D Attack Vector

More results are available on the CxOne platform

Fixed Issues (288)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CVE-2015-5346	Maven-org.apache.tomcat:tomcat-catalina-7.0.27
	CVE-2016-0714	Maven-org.apache.tomcat:tomcat-catalina-7.0.27
	CVE-2016-5388	Maven-org.apache.tomcat:tomcat-catalina-7.0.27
	CVE-2016-6797	Maven-org.apache.tomcat:tomcat-catalina-7.0.27
	CVE-2017-12615	Maven-org.apache.tomcat:tomcat-catalina-7.0.27
	CVE-2017-12616	Maven-org.apache.tomcat:tomcat-catalina-7.0.27
	CVE-2017-12617	Maven-org.apache.tomcat:tomcat-catalina-7.0.27
	CVE-2017-5648	Maven-org.apache.tomcat:tomcat-catalina-7.0.27
	CVE-2017-5664	Maven-org.apache.tomcat:tomcat-catalina-7.0.27
	CVE-2018-1336	Maven-org.apache.tomcat:tomcat-catalina-7.0.27
	CVE-2019-0232	Maven-org.apache.tomcat:tomcat-catalina-7.0.27
	CVE-2019-17563	Maven-org.apache.tomcat:tomcat-catalina-7.0.27
	CVE-2020-9484	Maven-org.apache.tomcat:tomcat-catalina-7.0.27
	CVE-2021-25329	Maven-org.apache.tomcat:tomcat-catalina-7.0.27
	Client_DOM_Code_Injection	/webgoat/src/main/webapp/javascript/menu_system.js: 139
	Client_DOM_Stored_Code_Injection	/webgoat/src/main/webapp/javascript/eval.js: 39
	Client_DOM_Stored_XSS	/webgoat/src/main/webapp/javascript/clientSideFiltering.js: 92
	Client_DOM_Stored_XSS	/webgoat/src/main/webapp/javascript/sameOrigin.js: 56
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/ClientSideValidation.java: 191
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/ClientSideValidation.java: 191
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/JavaScriptValidation.java: 109
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/Challenge2Screen.java: 793
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/Challenge2Screen.java: 793
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/JavaScriptValidation.java: 110
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 674
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/UncheckedEmail.java: 100
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/UncheckedEmail.java: 100
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/UncheckedEmail.java: 100
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/UncheckedEmail.java: 100
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/UncheckedEmail.java: 100
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/UncheckedEmail.java: 100
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/UncheckedEmail.java: 100
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/HttpSplitting.java: 153
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/HttpSplitting.java: 153
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/UncheckedEmail.java: 103
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/UncheckedEmail.java: 103
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/SqlStringInjection.java: 203
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/SqlStringInjection.java: 203
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/ParameterParser.java: 597
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/SqlNumericInjection.java: 98
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/lessons/SqlNumericInjection.java: 98
	Reflected_XSS_All_Clients	/webgoat/src/main/java/org/owasp/webgoat/session/WebSession.java: 816

More results are available on the CxOne platform

---

Use @Checkmarx to reach out to us for assistance.

Just send a PR comment with @Checkmarx followed by a natural language request.

Examples: @Checkmarx how are you able to help me? @Checkmarx rescan this PR