cn.eova:eova (>=1.6-beta4, <=1.6-beta5), cn.zcltd.btg:btg-autoroute-jfinal (3.0.3) +11 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (3.3)

com.jfinal:jfinal MAVEN version 3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.eova:eova =1.6-beta4, =1.0, =2.0.4, =1.0.0, =0.0.1, =2.0.2.v20171129-release, =2.2.0.v20180405-release Source cves:...

cc.ecore:spring-jfinal (0.0.1), cn.codeforfun:jfinal-activemq (0.3) +24 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (2.2)

com.jfinal:jfinal MAVEN version 2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cc.ecore:spring-jfinal 0.0.1 - cn.codeforfun:jfinal-activemq 0.3 - cn.codeforfun:jfinal-quartz 0.1 - cn.eova:eova =1.5.0, =2.2,...

cn.vonce:vonce-sqlbean (0.9.6), com.github.artislong:jfinal-spring-boot-starter (>=1.0, <=2.1) +12 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (>=4.0, <=4.4)

com.jfinal:jfinal MAVEN version =4.0, =1.0, =1.2.0, =2.0.4, =3.14.1.release, =1.8, =3.0.3, =2.1.1, =3.3.3.v20190620-release, =3.5.1.v20190826-release Source cves: CVE-2019-17352 Source advisory: GHSA-279P-PC38-XX4P...

cn.51daxia:zzz-websocket (>=1.0, <=1.1), com.github.grtechtv:enjoy-mapper (1.0.0) +17 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (3.8)

com.jfinal:jfinal MAVEN version 3.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.51daxia:zzz-websocket =1.0, =1.1 - com.github.grtechtv:enjoy-mapper 1.0.0 -...

cn.dreampie:jfinal-akka (0.1), cn.dreampie:jfinal-captcha (0.1) +16 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (1.8)

com.jfinal:jfinal MAVEN version 1.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.dreampie:jfinal-akka 0.1 - cn.dreampie:jfinal-captcha 0.1 - cn.dreampie:jfinal-coffeescript 0.1 - cn.dreampie:jfinal-dreampi...

cn.fsdev:jfinal-mail-plugin (3.0), cn.yerl.web:spring-boot-starter-sso-client (1.0.0) +10 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (3.0)

com.jfinal:jfinal MAVEN version 3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.fsdev:jfinal-mail-plugin 3.0 - cn.yerl.web:spring-boot-starter-sso-client 1.0.0 - com.ejlchina:bean-searcher =1.1.1, =0.2,...

com.github.subchen:jetbrick-template (>=1.0.0, <=1.2.6), com.github.zqq90.webit-script:webit-script (>=1.2.2, <=1.4.0) +3 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (1.5)

com.jfinal:jfinal MAVEN version 1.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.subchen:jetbrick-template =1.0.0, =1.2.2, =1.4.1, =2.0.0-beta, =2.7.0-beta Source cves: CVE-2019-17352 Source...

com.github.jieblog:jfinal-shiro (>=1.0, <=3.1.0), com.github.piaohao:act-jfinal (1.0) +9 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (3.1)

com.jfinal:jfinal MAVEN version 3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.github.jieblog:jfinal-shiro =1.0, =1.0-alpha2, =1.5.3, =1.0.0, =1.8.0, =1.8.2 Source cves: CVE-2019-17352 Source advisory:...

cn.dreampie:jfinal-dreampie (>=1.0, <=1.2.2), cn.dreampie:jfinal-lesscss (0.1) +8 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (1.9)

com.jfinal:jfinal MAVEN version 1.9 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.dreampie:jfinal-dreampie =1.0, =0.1, =0.1, =2.4.0, =3.1.3, =0.1, =0.0.1, =0.0.3 Source cves: CVE-2019-17352 Source advisory:...

cn.eova:eova (>=1.6-beta6, <=1.6.0), cn.zcltd.btg:btg-autoroute-jfinal (3.0.4) +12 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (3.4)

com.jfinal:jfinal MAVEN version 3.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cn.eova:eova =1.6-beta6, =0.0.2, =3.0.1, =1.3.0, =1.0.0, =2.3.0.v20180506-release, =2.3.0.v20180506-release,...

cc.ecore:spring-jfinal (0.0.1), cc.ecore:spring-jfinal-plugin (>=0.1.0, <=0.1.2) +134 more potentially affected by CVE-2019-17352 via com.jfinal:jfinal (>=1.4, <=4.4)

com.jfinal:jfinal MAVEN version =1.4, =0.1.0, =0.1.1, =1.0, =0.0.8, =0.0.8, =0.0.8, =0.1, =1.2.2 - cn.dreampie:jfinal-flyway 0.1 - cn.dreampie:jfinal-lesscss 0.1 and more Source cves: CVE-2019-17352 Source advisory: MEND:CVE-2019-17352...

CVE-2019-17352

CVE-2019-17352 affects JFinal cos prior to 2019-08-13 (JFinal 4.4). The isSafeFile() check can be bypassed, allowing upload of any file type (e.g., .jsp) with deletion not consistently executed; no remediation details are provided in the supplied documents.