Intel

AIKIDO-2024-10241

webdav-servlet is vulnerable to Use of Weak Hash

Use of Weak Hash Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Sep 3, 2024

23

Low Risk

This Affects:

javawebdav-servlet
1.0.0 - 1.2.69
Fixed in 1.2.70
Are you affected? Scan for Free

TL;DR

Affected versions of the package use the MD5 algorithm, which generates digests that fail to meet security standards for a hash function. This weakness allows adversaries to feasibly determine the original input.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

webdav-servlet is vulnerable to Use of Weak Hash in versions 1.0.0 - 1.2.69.

How to fix this

Upgrade the nl.info.webdav:webdav-servlet library to the patch version.