Added a change

[elangosenthilnathan]

No description provided.

[github-actions]

Checking analysis of application shiftleft-java-demo against 4 build rules.

Using sl version 0.9.2618 (7e88f2e3d8082789890aafa954e171343c7309c6).

no successful scan prior to scan 1 found in branch "master".

Checking findings on scan 1.

Results per rule:

• No critical or high SAST findings: FAIL
  (12 matched vulnerabilities; configured threshold is 0).

  First 5 findings:

  ID	CVSS	Rating	Title
  94	9.0	critical	Remote Code Execution: Code Injection Through Attacker-controlled Data via foo in SearchController.doGetSearch
  95	9.0	critical	Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie
  96	9.0	critical	Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings
  70	8.0	high	Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via foo in SearchController.doGetSearch
  71	8.0	high	Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via customerId in CustomerController.debug

  Severity rating	Count
  Critical	3
  High	9
  Medium	0
  Low	0

  Category	Count
  Cross-Site Scripting	8
  Directory Traversal	2
  Remote Code Execution	1
  Deserialization	1

  OWASP 2021 Category	Count
  A03-Injection	9
  A01-Broken-Access-Control	2
  A08-Software-And-Data-Integrity-Failures	1

• Allow 0 secrets: FAIL
  (7 matched vulnerabilities; configured threshold is 0).

  Findings:

  ID	CVSS	Rating	Title
  63	0.0	none	Hardcoded Sensitive Secrets/Credentials in Config
  64	0.0	none	Hardcoded Sensitive Secrets/Credentials in Config
  65	0.0	none	Hardcoded Sensitive Secrets/Credentials in Config
  66	0.0	none	Hardcoded Sensitive Secrets/Credentials in Config
  67	0.0	none	Hardcoded Sensitive Secrets/Credentials in Config
  68	0.0	none	Hardcoded Sensitive Secrets/Credentials in Config
  69	0.0	none	Hardcoded Sensitive Secrets/Credentials in Config

  Severity rating	Count
  Critical	0
  High	0
  Medium	0
  Low	0

  Category	Count
  Secret	7
  User	5
  Password	5
  URI	1
  Infra	1
  IaaS	1
  Amazon	1
  Access ID	1

• No reachable SCA findings: FAIL
  (43 matched vulnerabilities; configured threshold is 0).

  First 10 findings:

  ID	CVSS	Rating	CVE	Title
  312	10.0	critical	GMS-2022-559	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core.
  236	9.8	critical	CVE-2018-8014	The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insec…
  245	9.8	critical	CVE-2020-1938	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as ha…
  249	9.8	critical	CVE-2017-5651	In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing.…
  297	9.8	critical	CVE-2018-1270	Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over …
  305	9.8	critical	CVE-2018-1275	Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over …
  314	9.8	critical	CVE-2016-1000027	Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. De…
  235	9.1	critical	CVE-2017-5648	While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.R…
  311	8.8	high	CVE-2020-5421	In Spring Framework the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessioni…
  263	8.6	high	CVE-2022-25762	If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apac…

  Severity rating	Count
  Critical	8
  High	35
  Medium	0
  Low	0

• No critical or high container findings: pass
  (0 matched vulnerabilities; configured threshold is 0).

3 rules failed.