基础信息
项目名称：spring-petclinic/spring-framework-petclinic
项目徽章：
仓库地址：https://github.com/pterodactyl/panel
检测报告地址：https://www.murphysec.com/console/report/1755402701550415872/1755402701596553216
此报告由Murphysec提供
漏洞列表
| 漏洞名称 | 漏洞类型 | MPS编号 | CVE编号 | 漏洞等级 |
|---|---|---|---|---|
| Spring Framework 拒绝服务漏洞 | MPS-1za4-g3fd | CVE-2024-22233 | 高危 |
缺陷组件
| 组件名称 | 版本 | 最小修复版本 | 依赖关系 | 修复建议 |
|---|---|---|---|---|
| org.springframework:spring-core | 6.1.2 | 6.1.3 | 间接依赖 | 可选修复 |
许可证风险
| 许可证类型 | 相关组件 | 许可证风险 |
|---|---|---|
| Apache-2.0 | 35 | 低 |
| EDL-1.0 | 8 | 低 |
| AND | 1 | 低 |
| BSD-2-Clause | 2 | 低 |
| EPL-2.0 | 10 | 低 |
| LGPL-2.1 | 5 | 中 |
| EPL-1.0 | 3 | 低 |
| MIT | 4 | 低 |
| BSD-3-Clause | 1 | 低 |
| GPL-2.0-with-classpath-exception | 5 | 中 |
| GPL-2.0 | 1 | 中 |
SBOM清单
| 组件名称 | 组件版本 | 是否直接依赖 | 仓库 |
|---|---|---|---|
| jakarta.validation:jakarta.validation-api | 3.0.2 | 间接依赖 | maven |
| io.smallrye:jandex | 3.1.2 | 间接依赖 | maven |
| com.sun.istack:istack-commons-runtime | 4.1.2 | 间接依赖 | maven |
| io.micrometer:micrometer-commons | 1.12.1 | 间接依赖 | maven |
| org.springframework:spring-expression | 6.1.2 | 间接依赖 | maven |
| io.micrometer:micrometer-observation | 1.12.1 | 间接依赖 | maven |
| net.bytebuddy:byte-buddy | 1.14.7 | 间接依赖 | maven |
| com.h2database:h2 | 2.2.224 | 直接依赖 | maven |
| org.apache.tomcat:tomcat-jdbc | 10.1.17 | 直接依赖 | maven |
| org.glassfish.jaxb:txw2 | 4.0.4 | 间接依赖 | maven |
| org.hsqldb:hsqldb | 2.7.2 | 直接依赖 | maven |
| org.junit.platform:junit-platform-engine | 1.10.1 | 间接依赖 | maven |
| ch.qos.logback:logback-classic | 1.4.14 | 直接依赖 | maven |
| org.hibernate.orm:hibernate-core | 6.4.1.Final | 直接依赖 | maven |
| org.springframework:spring-oxm | 6.1.2 | 直接依赖 | maven |
| org.eclipse.angus:angus-activation | 2.0.1 | 间接依赖 | maven |
| org.opentest4j:opentest4j | 1.3.0 | 间接依赖 | maven |
| org.springframework.data:spring-data-jpa | 3.2.1 | 直接依赖 | maven |
| org.springframework:spring-webmvc | 6.1.2 | 直接依赖 | maven |
| jakarta.xml.bind:jakarta.xml.bind-api | 4.0.1 | 直接依赖 | maven |
| org.jboss.logging:jboss-logging | 3.5.0.Final | 间接依赖 | maven |
| com.google.errorprone:error_prone_annotations | 2.21.1 | 间接依赖 | maven |
| jakarta.persistence:jakarta.persistence-api | 3.1.0 | 直接依赖 | maven |
| com.fasterxml:classmate | 1.5.1 | 间接依赖 | maven |
| jakarta.inject:jakarta.inject-api | 2.0.1 | 间接依赖 | maven |
| org.hibernate.validator:hibernate-validator | 8.0.1.Final | 直接依赖 | maven |
| org.hibernate.common:hibernate-commons-annotations | 6.0.6.Final | 间接依赖 | maven |
| org.apiguardian:apiguardian-api | 1.1.2 | 间接依赖 | maven |
| org.springframework:spring-aop | 6.1.2 | 间接依赖 | maven |
| org.springframework.data:spring-data-commons | 3.2.1 | 间接依赖 | maven |
| org.junit.platform:junit-platform-commons | 1.10.1 | 间接依赖 | maven |
| org.webjars.npm:flatpickr | 4.6.13 | 直接依赖 | maven |
| ch.qos.logback:logback-core | 1.4.14 | 间接依赖 | maven |
| org.antlr:antlr4-runtime | 4.13.0 | 间接依赖 | maven |
| org.springframework:spring-jcl | 6.1.2 | 间接依赖 | maven |
| org.postgresql:postgresql | 42.6.0 | 直接依赖 | maven |
| org.springframework:spring-beans | 6.1.2 | 间接依赖 | maven |
| jakarta.transaction:jakarta.transaction-api | 2.0.1 | 间接依赖 | maven |
| org.checkerframework:checker-qual | 3.37.0 | 间接依赖 | maven |
| com.fasterxml.jackson.core:jackson-annotations | 2.16.0 | 间接依赖 | maven |
| org.webjars:bootstrap | 5.3.2 | 直接依赖 | maven |
| org.glassfish.web:jakarta.servlet.jsp.jstl | 3.0.1 | 直接依赖 | maven |
| org.hibernate.orm:hibernate-jcache | 6.4.1.Final | 直接依赖 | maven |
| org.apache.tomcat:tomcat-juli | 10.1.17 | 间接依赖 | maven |
| jakarta.el:jakarta.el-api | 5.0.0 | 间接依赖 | maven |
| org.springframework:spring-context-support | 6.1.2 | 直接依赖 | maven |
| org.springframework:spring-core | 6.1.2 | 间接依赖 | maven |
| org.mockito:mockito-junit-jupiter | 5.8.0 | 直接依赖 | maven |
| com.github.ben-manes.caffeine:caffeine | 3.1.8 | 直接依赖 | maven |
| org.springframework:spring-orm | 6.1.2 | 直接依赖 | maven |
| org.junit.jupiter:junit-jupiter-engine | 5.10.1 | 直接依赖 | maven |
| com.fasterxml.jackson.core:jackson-databind | 2.16.0 | 直接依赖 | maven |
| javax.cache:cache-api | 1.0.0 | 间接依赖 | maven |
| org.springframework:spring-web | 6.1.2 | 间接依赖 | maven |
| org.aspectj:aspectjweaver | 1.9.21 | 直接依赖 | maven |
| org.junit.jupiter:junit-jupiter-api | 5.10.1 | 间接依赖 | maven |
| org.springframework:spring-jdbc | 6.1.2 | 直接依赖 | maven |
| jakarta.annotation:jakarta.annotation-api | 2.0.0 | 间接依赖 | maven |
| org.slf4j:slf4j-api | 2.0.9 | 直接依赖 | maven |
| org.springframework:spring-context | 6.1.2 | 间接依赖 | maven |
| mysql:mysql-connector-java | 8.1.0 | 直接依赖 | maven |
| jakarta.servlet.jsp.jstl:jakarta.servlet.jsp.jstl-api | 3.0.0 | 直接依赖 | maven |
| org.glassfish.jaxb:jaxb-core | 4.0.4 | 间接依赖 | maven |
| jakarta.activation:jakarta.activation-api | 2.1.2 | 直接依赖 | maven |
| org.webjars.npm:font-awesome | 4.7.0 | 直接依赖 | maven |
| com.fasterxml.jackson.core:jackson-core | 2.16.0 | 直接依赖 | maven |
| org.glassfish.jaxb:jaxb-runtime | 4.0.4 | 直接依赖 | maven |
| org.springframework:spring-tx | 6.1.2 | 间接依赖 | maven |