[Snyk] Security upgrade io.jsonwebtoken:jjwt from 0.9.1 to 0.12.0

[RoyHarrow]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• webgoat-lessons/challenge/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Denial of Service (DoS) SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538	721	io.jsonwebtoken:jjwt: 0.9.1 -> 0.12.0 No Known Exploit

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)

[RoyHarrow]

Checkmarx One – Scan Summary & Details – 3f231d63-9bbd-443e-8ee5-c74fc76f49a5

New Issues

Severity	Issue	Source File / Package	Checkmarx Insight
	CVE-2021-23358	Npm-underscore-1.10.2	Vulnerable Package
	CVE-2023-34034	Maven-org.springframework.security:spring-security-config-5.5.2	Vulnerable Package
	CVE-2023-34034	Maven-org.springframework.security:spring-security-web-5.5.2	Vulnerable Package
	CVE-2023-51775	Maven-org.bitbucket.b_c:jose4j-0.7.6	Vulnerable Package
	CVE-2023-5379	Maven-io.undertow:undertow-core-2.2.10.Final	Vulnerable Package
	CVE-2023-5685	Maven-org.jboss.xnio:xnio-api-3.8.4.Final	Vulnerable Package
	CVE-2023-6481	Maven-ch.qos.logback:logback-core-1.2.5	Vulnerable Package
	CVE-2024-1597	Maven-org.postgresql:postgresql-42.2.23	Vulnerable Package
	CVE-2024-22243	Maven-org.springframework:spring-web-5.3.9	Vulnerable Package
	CVE-2024-22257	Maven-org.springframework.security:spring-security-core-5.5.2	Vulnerable Package
	CVE-2024-22259	Maven-org.springframework:spring-web-5.3.9	Vulnerable Package
	CVE-2024-22262	Maven-org.springframework:spring-web-5.3.9	Vulnerable Package
	CVE-2024-31573	Maven-org.xmlunit:xmlunit-core-2.8.2	Vulnerable Package
	CVE-2024-5971	Maven-io.undertow:undertow-core-2.2.10.Final	Vulnerable Package
	CVE-2024-6162	Maven-io.undertow:undertow-core-2.2.10.Final	Vulnerable Package
	Absolute_Path_Traversal	/webwolf/src/main/java/org/owasp/webwolf/FileServer.java: 69	Attack Vector
	Absolute_Path_Traversal	/webgoat-lessons/path-traversal/src/main/java/org/owasp/webgoat/path_traversal/ProfileUpload.java: 28	Attack Vector
	Absolute_Path_Traversal	/webgoat-lessons/path-traversal/src/main/java/org/owasp/webgoat/path_traversal/ProfileUploadFix.java: 29	Attack Vector
	Absolute_Path_Traversal	/webgoat-lessons/path-traversal/src/main/java/org/owasp/webgoat/path_traversal/ProfileUploadRemoveUserInput.java: 26	Attack Vector
	Absolute_Path_Traversal	/webgoat-lessons/path-traversal/src/main/java/org/owasp/webgoat/path_traversal/ProfileZipSlip.java: 36	Attack Vector
	Absolute_Path_Traversal	/webgoat-lessons/path-traversal/src/main/java/org/owasp/webgoat/path_traversal/ProfileZipSlip.java: 36	Attack Vector
	CVE-2023-51074	Maven-com.jayway.jsonpath:json-path-2.5.0	Vulnerable Package
	CVE-2024-1459	Maven-io.undertow:undertow-core-2.2.10.Final	Vulnerable Package
	CVE-2024-25710	Maven-org.apache.commons:commons-compress-1.20	Vulnerable Package
	CVE-2024-3653	Maven-io.undertow:undertow-core-2.2.10.Final	Vulnerable Package
	CVE-2024-6484	Maven-org.webjars:bootstrap-3.3.7	Vulnerable Package
	CVE-2024-6484	Npm-bootstrap-3.1.1	Vulnerable Package
	CVE-2024-6485	Npm-bootstrap-3.1.1	Vulnerable Package
	CVE-2024-6485	Maven-org.webjars:bootstrap-3.3.7	Vulnerable Package
	Improper_Restriction_of_XXE_Ref	/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/xxe/ContentTypeAssignment.java: 60	Attack Vector
	Improper_Restriction_of_XXE_Ref	/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/xxe/SimpleXXE.java: 69	Attack Vector
	Improper_Restriction_of_XXE_Ref	/webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/xxe/BlindSendFileAssignment.java: 79	Attack Vector
	JWT_Sensitive_Information_Exposure	/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTRefreshEndpoint.java: 129	Attack Vector
	Parameter_Tampering	/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionChallenge.java: 56	Attack Vector
	Parameter_Tampering	/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/mitigation/Servers.java: 67	Attack Vector
	Parameter_Tampering	/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionLesson6a.java: 51	Attack Vector
	SSRF	/webgoat-lessons/password-reset/src/main/java/org/owasp/webgoat/password_reset/ResetLinkAssignmentForgotPassword.java: 65	Attack Vector
	Update Instruction Alone	/Dockerfile: 5	Instruction 'RUN update' should always be followed by ' install' in the same RUN statement
	Use_Of_Hardcoded_Password	/webgoat-integration-tests/src/test/java/org/owasp/webgoat/ChallengeTest.java: 80	Attack Vector
	Use_Of_Hardcoded_Password	/webgoat-integration-tests/src/test/java/org/owasp/webgoat/CSRFTest.java: 190	Attack Vector
	Use_Of_Hardcoded_Password	/webgoat-integration-tests/src/test/java/org/owasp/webgoat/GeneralLessonTest.java: 92	Attack Vector
	Use_Of_Hardcoded_Password	/webgoat-integration-tests/src/test/java/org/owasp/webgoat/GeneralLessonTest.java: 102	Attack Vector
	Use_Of_Hardcoded_Password	/webgoat-integration-tests/src/test/java/org/owasp/webgoat/IDORTest.java: 48	Attack Vector
	Use_Of_Hardcoded_Password	/webgoat-integration-tests/src/test/java/org/owasp/webgoat/SqlInjectionAdvancedTest.java: 17	Attack Vector
	Use_Of_Hardcoded_Password	/webgoat-integration-tests/src/test/java/org/owasp/webgoat/SqlInjectionAdvancedTest.java: 19	Attack Vector
	Use_Of_Hardcoded_Password	/webgoat-integration-tests/src/test/java/org/owasp/webgoat/SqlInjectionAdvancedTest.java: 24	Attack Vector

Fixed Issues

Severity	Issue	Source File / Package
	CVE-2022-40151	Maven-com.thoughtworks.xstream:xstream-1.4.5
	Reflected_XSS_All_Clients	/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/HashingAssignment.java: 69
	Reflected_XSS_All_Clients	/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/SigningAssignment.java: 50
	Reflected_XSS_All_Clients	/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/HashingAssignment.java: 49
	Reflected_XSS_All_Clients	/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/HashingAssignment.java: 69
	Reflected_XSS_All_Clients	/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/SigningAssignment.java: 50
	Reflected_XSS_All_Clients	/webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/HashingAssignment.java: 49
	CVE-2007-2379	Npm-jquery-2.1.4
	CVE-2007-2379	Npm-jquery-1.10.2
	CVE-2007-2379	Maven-org.webjars:jquery-3.5.1
	CVE-2014-6071	Maven-org.webjars:jquery-3.5.1
	CVE-2014-6071	Npm-jquery-1.10.2
	CVE-2014-6071	Npm-jquery-2.1.4
	Cleartext_Submission_of_Sensitive_Information	/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTVotesEndpoint.java: 103
	Cleartext_Submission_of_Sensitive_Information	/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTVotesEndpoint.java: 103
	Cleartext_Submission_of_Sensitive_Information	/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTVotesEndpoint.java: 103
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 107
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 106
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 105
	Client_Potential_XSS	/webgoat-lessons/csrf/src/main/resources/js/csrf-review.js: 39
	Client_Potential_XSS	/webgoat-lessons/xxe/src/main/resources/js/xxe.js: 77
	Client_Potential_XSS	/webgoat-lessons/cross-site-scripting/src/main/resources/js/stored-xss.js: 39
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/libs/ace.js: 21469
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 106
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 107
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 105
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 106
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 107
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 105
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 107
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 106
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 105
	Client_Potential_XSS	/webgoat-lessons/csrf/src/main/resources/js/csrf-review.js: 39
	Client_Potential_XSS	/webgoat-lessons/xxe/src/main/resources/js/xxe.js: 77
	Client_Potential_XSS	/webgoat-lessons/cross-site-scripting/src/main/resources/js/stored-xss.js: 39
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/libs/ace.js: 21469
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 107
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 107
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 106
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 106
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 105
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js: 105
	Client_Potential_XSS	/webgoat-lessons/csrf/src/main/resources/js/csrf-review.js: 39
	Client_Potential_XSS	/webgoat-lessons/xxe/src/main/resources/js/xxe.js: 77
	Client_Potential_XSS	/webgoat-lessons/cross-site-scripting/src/main/resources/js/stored-xss.js: 39
	Client_Potential_XSS	/webgoat-container/src/main/resources/static/js/libs/ace.js: 21469
	Client_Potential_XSS	/webgoat-lessons/csrf/src/main/resources/js/csrf-review.js: 39
	Client_Potential_XSS	/webgoat-lessons/xxe/src/main/resources/js/xxe.js: 77
	Client_Potential_XSS	/webgoat-lessons/cross-site-scripting/src/main/resources/js/stored-xss.js: 39
	Excessive_Data_Exposure	/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/missing_ac/MissingFunctionACUsers.java: 83
	Excessive_Data_Exposure	/webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/missing_ac/MissingFunctionACUsers.java: 75
	Excessive_Data_Exposure	/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTSecretKeyEndpoint.java: 71
	Input_Path_Not_Canonicalized	/webwolf/src/main/java/org/owasp/webwolf/FileServer.java: 69
	Input_Path_Not_Canonicalized	/webwolf/src/main/java/org/owasp/webwolf/FileServer.java: 69
	Input_Path_Not_Canonicalized	/webgoat-lessons/path-traversal/src/main/java/org/owasp/webgoat/path_traversal/ProfileUploadRetrieval.java: 79
	Input_Path_Not_Canonicalized	/webgoat-lessons/path-traversal/src/main/java/org/owasp/webgoat/path_traversal/ProfileUploadRetrieval.java: 85
	Input_Path_Not_Canonicalized	/webwolf/src/main/java/org/owasp/webwolf/FileServer.java: 69
	Input_Path_Not_Canonicalized	/webwolf/src/main/java/org/owasp/webwolf/FileServer.java: 69
	Input_Path_Not_Canonicalized	/webgoat-lessons/path-traversal/src/main/java/org/owasp/webgoat/path_traversal/ProfileZipSlip.java: 60
	JWT_Lack_Of_Expiration_Time	/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTRefreshEndpoint.java: 84
	JWT_Lack_Of_Expiration_Time	/webgoat-lessons/jwt/src/test/java/org/owasp/webgoat/jwt/JWTVotesEndpointTest.java: 199
	JWT_Lack_Of_Expiration_Time	/webgoat-lessons/jwt/src/test/java/org/owasp/webgoat/jwt/TokenTest.java: 47
	JWT_Lack_Of_Expiration_Time	/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTVotesEndpoint.java: 101
	JWT_Lack_Of_Expiration_Time	/webgoat-lessons/jwt/src/test/java/org/owasp/webgoat/jwt/TokenTest.java: 70
	JWT_Lack_Of_Expiration_Time	/webgoat-lessons/jwt/src/test/java/org/owasp/webgoat/jwt/JWTSecretKeyEndpointTest.java: 90
	JWT_Lack_Of_Expiration_Time	/webgoat-lessons/jwt/src/test/java/org/owasp/webgoat/jwt/JWTVotesEndpointTest.java: 187
	JWT_Lack_Of_Expiration_Time	/webgoat-lessons/jwt/src/test/java/org/owasp/webgoat/jwt/JWTSecretKeyEndpointTest.java: 135
	JWT_Lack_Of_Expiration_Time	/webgoat-lessons/jwt/src/test/java/org/owasp/webgoat/jwt/JWTSecretKeyEndpointTest.java: 113
	JWT_Lack_Of_Expiration_Time	/webgoat-lessons/jwt/src/test/java/org/owasp/webgoat/jwt/JWTVotesEndpointTest.java: 71
	JWT_Lack_Of_Expiration_Time	/webgoat-lessons/jwt/src/test/java/org/owasp/webgoat/jwt/JWTFinalEndpointTest.java: 46
	JWT_Lack_Of_Expiration_Time	/webgoat-lessons/jwt/src/test/java/org/owasp/webgoat/jwt/JWTSecretKeyEndpointTest.java: 124
	JWT_Lack_Of_Expiration_Time	/webgoat-lessons/jwt/src/test/java/org/owasp/webgoat/jwt/JWTSecretKeyEndpointTest.java: 79
	JWT_Lack_Of_Expiration_Time	/webgoat-lessons/jwt/src/test/java/org/owasp/webgoat/jwt/JWTSecretKeyEndpointTest.java: 102
	JWT_No_Signature_Verification	/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTFinalEndpoint.java: 92
	JWT_No_Signature_Verification	/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTFinalEndpoint.java: 92
	JWT_No_Signature_Verification	/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTFinalEndpoint.java: 92
	JWT_No_Signature_Verification	/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTFinalEndpoint.java: 92
	JWT_Sensitive_Information_Exposure	/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTRefreshEndpoint.java: 62
	JWT_Sensitive_Information_Exposure	/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTVotesEndpoint.java: 70
	JWT_Sensitive_Information_Exposure	/webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTVotesEndpoint.java: 70
	JWT_Sensitive_Information_Exposure

More results are available on AST platform