ESL SBOMator | Direct NVD Links

ESL SBOMator

Professional SBOM Analysis & Vulnerability Management

www.eswlab.com | Engineering Software Lab

ESL SBOMator Logo

ESL SBOMator

Project in Report:

WebGoat

Report created: 2026-08-24 11:36:27

⚠️ SBOM DATA QUALITY WARNING — DO NOT SUBMIT TO REGULATORS ⚠️

🔴 1 component(s) with unresolved versions: jackson-datatype-jsr310

🔴 5 component(s) with missing licenses: jspecify, HdrHistogram, jitescript, jcip-annotations, xpp3_min

Why this matters: FDA 21 CFR §820.45 and the NTIA minimum elements require every SBOM component to have a defined version and license. Unresolved versions prevent CVE matching — "0 CVEs" for these components means not analyzed, not no vulnerabilities.

jackson-datatype-jsr310
Why unresolved: The component is present, but no trustworthy release identifier was found in its source, manifest, or binary metadata.
Evidence needed: Provide the delivered artifact or an authoritative package/build manifest.

How to fix:

  • For Python projects: create a requirements.txt with pinned versions (e.g. flask==3.0.3) instead of floor constraints (e.g. flask>=2.0.0), then re-scan.
  • Run pip freeze > requirements.txt in the project's virtual environment to capture exact installed versions.
  • For missing licenses: enable Online Mode to fetch license metadata from PyPI/npm/Maven registries, or manually add license info to the SBOM.

202

Total Components

11

Vulnerable Components

111

App CVEs

0

Vendored SDK CVEs

5.4%

Components with Known CVEs

🤖 AI/ML SBOM Profile

Status: Enabled

Checking Level: Medium

AI SBOM add-on metadata is present.
The scan requested AI model/framework, dataset, infrastructure, and AI minimum-elements review guidance. Some AI fields still require manual confirmation, including dataset provenance, data sensitivity, training/fine-tuning method, user-data retention, and implemented AI security controls.

Public-Code Provenance Review

Status: failed

Controls: scope=unknown, backend=public, providers=none, privacy-filtered lines=0.

Coverage: 0 source files considered, 0 windows sampled, 0 backend queries performed (limits: 0 files, 0 sampled windows).

Sampling priority: 0 unidentified-source windows, 0 known-component windows; 0 canonical-upstream verification queries.

The scan failed; this is not proof that the code is original or license-clear.
One or more privacy-filtered source samples may have been sent to the selected public-code search destinations before the scan failed.
Local fileLinePotential sourceCandidate-repository licenseMatch evidence
No conclusion is available from this review.

0

Ransomware CVEs

Used in ransomware campaigns

1

Weaponized CVEs

Actively exploited in wild

108

No Known Exploitation

CVEs without active exploitation

2

Exploitation Not Assessed

No KEV analysis evidence in this SBOM

🏢 Vendor/Manufacturer Distribution

VMware
67 components
33.2%
Apache
13 components
6.4%
FasterXML
13 components
6.4%
Eclipse Foundation
12 components
5.9%
OW2 Consortium
11 components
5.4%

Vulnerability Severity Distribution

20 Critical
61 High
25 Medium
4 Low
0 Unknown

Click any CVE/advisory ID below to view detailed vulnerability information from the source database

SBOM Version and License Quality Gate

BLOCKED. 6 unresolved component field(s) lack a valid, matching approval. This SBOM is NOT regulator-ready. Resolve each field below or add a component-specific approval to .sbomator_component_suppressions.json.
201
Non-placeholder version values
0
Justified version exceptions
197
Non-placeholder license values
0
Justified license exceptions
ComponentIDFieldObserved ValueReason
org.jspecify/jspecifypkg:maven/org.jspecify/jspecify@1.0.0license<missing>no valid component-specific approval was found
com.fasterxml.jackson.datatype/jackson-datatype-jsr310pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jsr310@UNKNOWNversion<missing>no valid component-specific approval was found
org.hdrhistogram/HdrHistogrampkg:maven/org.hdrhistogram/HdrHistogram@2.2.2license<missing>no valid component-specific approval was found
me.qmx.jitescript/jitescriptpkg:maven/me.qmx.jitescript/jitescript@0.4.1license<missing>no valid component-specific approval was found
com.github.stephenc.jcip/jcip-annotationspkg:maven/com.github.stephenc.jcip/jcip-annotations@1.0-1license<missing>no valid component-specific approval was found
xpp3/xpp3_minpkg:maven/xpp3/xpp3_min@1.1.4clicense<missing>no valid component-specific approval was found

No approved version or license exceptions were required.

Component Vulnerability Analysis

OSV/PyPA/GHSA enrichment: Queried 201 ecosystem package(s) via OSV.dev querybatch API and added 0 additional advisories.
CVE analysis coverage (configured sources): 11 matched 190 scanned, no CVE 1 not analyzed
1 of 202 components (0%) could not be assessed by the configured CVE sources (for example: no concrete version, no queryable package identity, or an excluded system component), so their absence of CVEs is not evidence they are unaffected. Only the 190 "scanned, no CVE" components were queried and returned no version-applicable advisory. See each component's esl:cve_analysis property for its exact status and reason.
Threat-Based Prioritization: Components are sorted by security threat level: RANSOMWARE WEAPONIZED Standard CVEs No CVEs
Component Version Type Vendor License CVEs Score Severity Vulnerabilities (Click CVE IDs)
xstream WEAPONIZED 1.4.5 library 📦 XStream
Source: maven_group		 MIT
NPM		 36 9.8 Critical
Code Injection 3 CVEs
CVE-2021-39144 WEAPONIZED CWE-94 CWE-502 +2 EPSS 98.1% Grype CVE-2021-29505 CWE-94 CWE-502 +1 EPSS 77.2% Grype CVE-2021-21345 CWE-94 CWE-502 +1 EPSS 72.3% Grype
OS Command Injection 3 CVEs
CVE-2020-26217 CWE-78 CWE-78 EPSS 85.0% Grype CVE-2013-7285 CWE-78 EPSS 84.4% Grype CVE-2020-26259 CWE-78 CWE-78 EPSS 82.4% Grype
Deserialization of Untrusted Data 23 CVEs
CVE-2021-21351 CWE-434 CWE-502 EPSS 82.1% Grype CVE-2021-21346 CWE-434 CWE-502 +2 EPSS 76.4% Grype CVE-2021-21344 CWE-434 CWE-502 EPSS 76.0% Grype CVE-2021-21342 CWE-502 CWE-918 +1 EPSS 50.0% Grype
CVE-2021-21349 CWE-502 CWE-918 +1 EPSS 46.8% Grype CVE-2021-21343 CWE-73 CWE-502 EPSS 46.7% Grype CVE-2021-39141 CWE-434 CWE-502 +2 EPSS 16.1% Grype CVE-2021-21350 CWE-434 CWE-502 EPSS 15.2% Grype
CVE-2021-21347 CWE-434 CWE-502 +2 EPSS 14.3% Grype CVE-2021-39146 CWE-434 CWE-502 +2 EPSS 14.3% Grype CVE-2021-39152 CWE-502 CWE-918 +2 EPSS 11.4% Grype CVE-2022-41966 CWE-120 CWE-121 +2 EPSS 8.7% Grype
CVE-2021-39140 CWE-502 CWE-835 +2 EPSS 5.9% Grype CVE-2021-39149 CWE-434 CWE-502 +2 EPSS 4.7% Grype CVE-2021-39147 CWE-434 CWE-502 +2 EPSS 4.7% Grype CVE-2021-39151 CWE-434 CWE-502 +2 EPSS 4.7% Grype
CVE-2021-39154 CWE-434 CWE-502 +2 EPSS 4.7% Grype CVE-2021-39148 CWE-434 CWE-502 +2 EPSS 4.7% Grype CVE-2021-39139 CWE-434 CWE-502 +2 EPSS 4.5% Grype CVE-2021-39153 CWE-434 CWE-502 +2 EPSS 4.5% Grype
CVE-2021-39145 CWE-434 CWE-502 +1 EPSS 4.1% Grype CVE-2021-39150 CWE-502 CWE-918 +2 EPSS 3.4% Grype CVE-2024-47072 CWE-121 CWE-502 EPSS 2.0% Grype
Server-Side Request Forgery 1 CVE
CVE-2020-26258 CWE-918 CWE-918 EPSS 81.8% Grype
Uncontrolled Resource Consumption 3 CVEs
CVE-2021-21341 CWE-400 CWE-502 +1 EPSS 77.8% Grype CVE-2021-21348 CWE-400 CWE-502 +1 EPSS 13.8% Grype CVE-2021-43859 CWE-400 CWE-400 EPSS 7.9% Grype
Exposure of Sensitive Information 1 CVE
CVE-2016-3674 CWE-200 EPSS 8.2% Grype
Denial of service in XStream 1 CVE
CVE-2017-7957 CWE-20 EPSS 4.9% Grype
Out-of-Bounds Write 1 CVE
jackson-databind 2.9.6 library 📦 FasterXML
Source: existing		 Apache-2.0 62 10.0 Critical
Deserialization of Untrusted Data 56 CVEs
CVE-2019-12384 CWE-502 EPSS 45.2% Grype CVE-2020-8840 CWE-502 EPSS 26.6% Grype CVE-2019-12086 CWE-502 EPSS 21.9% Grype CVE-2020-36179 CWE-502 CWE-502 EPSS 20.9% Grype
CVE-2020-9548 CWE-502 EPSS 18.3% Grype CVE-2020-9547 CWE-502 EPSS 17.8% Grype CVE-2018-14718 CWE-502 EPSS 12.7% Grype CVE-2020-35728 CWE-502 CWE-502 EPSS 12.5% Grype
CVE-2019-12814 CWE-502 CWE-502 EPSS 11.0% Grype CVE-2020-36188 CWE-502 EPSS 10.9% Grype CVE-2019-14439 CWE-502 EPSS 10.8% Grype CVE-2019-14540 CWE-502 EPSS 10.8% Grype
CVE-2020-36184 CWE-502 CWE-502 EPSS 10.4% Grype CVE-2018-14719 CWE-502 EPSS 9.7% Grype CVE-2018-19362 CWE-502 EPSS 9.6% Grype CVE-2018-19360 CWE-502 EPSS 9.6% Grype
CVE-2018-19361 CWE-502 EPSS 9.6% Grype CVE-2020-35491 CWE-502 EPSS 9.5% Grype CVE-2020-24616 CWE-502 EPSS 9.4% Grype CVE-2019-20330 CWE-502 EPSS 8.6% Grype
CVE-2020-14060 CWE-502 EPSS 8.6% Grype CVE-2019-14379 CWE-1321 EPSS 8.1% Grype CVE-2020-14062 CWE-502 EPSS 8.1% Grype CVE-2020-10673 NVD-CWE-Other CWE-502 EPSS 8.0% Grype
CVE-2020-35490 CWE-502 EPSS 7.7% Grype CVE-2021-20190 CWE-502 CWE-502 EPSS 7.5% Grype CVE-2020-24750 CWE-502 EPSS 7.3% Grype CVE-2018-14720 CWE-502 CWE-611 EPSS 7.1% Grype
CVE-2020-11113 CWE-502 CWE-502 EPSS 6.3% Grype CVE-2020-11620 CWE-502 EPSS 5.8% Grype CVE-2019-16942 CWE-502 EPSS 5.7% Grype CVE-2019-17531 CWE-502 EPSS 5.4% Grype
CVE-2020-36185 CWE-502 EPSS 5.2% Grype CVE-2020-36186 CWE-502 EPSS 5.2% Grype CVE-2020-36187 CWE-502 EPSS 5.2% Grype CVE-2020-36180 CWE-502 CWE-502 EPSS 5.0% Grype
CVE-2020-36182 CWE-502 CWE-502 EPSS 5.0% Grype CVE-2020-36181 CWE-502 CWE-502 EPSS 5.0% Grype CVE-2019-16335 CWE-502 EPSS 5.0% Grype CVE-2020-36189 CWE-502 EPSS 4.9% Grype
CVE-2019-16943 CWE-502 EPSS 4.9% Grype CVE-2020-36183 CWE-502 EPSS 4.9% Grype CVE-2019-17267 CWE-502 EPSS 4.6% Grype CVE-2020-9546 CWE-502 EPSS 4.6% Grype
CVE-2020-14195 CWE-502 EPSS 4.5% Grype CVE-2020-14061 CWE-502 CWE-502 EPSS 4.5% Grype CVE-2020-11619 CWE-502 EPSS 3.7% Grype CVE-2020-11112 CWE-502 CWE-502 EPSS 3.7% Grype
CVE-2020-10968 CWE-502 CWE-502 EPSS 3.6% Grype CVE-2020-11111 CWE-502 CWE-502 EPSS 3.6% Grype CVE-2020-10969 CWE-502 CWE-502 EPSS 3.6% Grype CVE-2020-10650 CWE-502 CWE-502 EPSS 3.3% Grype
CVE-2020-10672 NVD-CWE-Other CWE-502 EPSS 3.1% Grype CVE-2022-42003 CWE-502 EPSS 2.8% Grype CVE-2022-42004 CWE-502 EPSS 2.8% Grype CVE-2026-54515 CWE-915 EPSS 0.3% Grype
XML External Entity Reference 1 CVE
CVE-2020-25649 CWE-611 CWE-611 EPSS 17.6% Grype
Server-Side Request Forgery 2 CVEs
CVE-2018-14721 CWE-918 EPSS 10.1% Grype CVE-2026-54514 CWE-918 EPSS 0.2% Grype
Exposure of Sensitive Information 2 CVEs
CVE-2019-14892 CWE-200 CWE-502 +1 EPSS 5.6% Grype CVE-2019-14893 CWE-200 CWE-502 +1 EPSS 4.1% Grype
Out-of-Bounds Write 1 CVE
jackson-databind 3.1.1 library 📦 FasterXML
Source: registry_cache:maven_pom		 Apache-2.0 9 8.1 High
Deserialization of Untrusted Data 3 CVEs
CVE-2026-54512 CWE-184 CWE-502 EPSS 0.8% Grype CVE-2026-59889 CWE-863 EPSS 0.3% Grype CVE-2026-54515 CWE-915 EPSS 0.3% Grype
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) 1 CVE
jackson-databind has @JsonView bypass for setterless creator properties 1 CVE
CVE-2026-54517 CWE-863 EPSS 0.3% Grype
jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields 1 CVE
CVE-2026-54516 CWE-915 EPSS 0.3% Grype
jackson-databind has a @JsonView bypass for unwrapped creator parameters 1 CVE
CVE-2026-54518 CWE-863 EPSS 0.3% Grype
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy 1 CVE
CVE-2026-59888 CWE-915 EPSS 0.2% Grype
Server-Side Request Forgery 1 CVE
CVE-2026-54514 CWE-918 EPSS 0.2% Grype
jackson-databind 2.21.2 library 📦 FasterXML
Source: existing		 Apache-2.0 10 8.1 High
Deserialization of Untrusted Data 3 CVEs
CVE-2026-54512 CWE-184 CWE-502 EPSS 0.8% Grype CVE-2026-59889 CWE-863 EPSS 0.3% Grype CVE-2026-54515 CWE-915 EPSS 0.3% Grype
jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) 1 CVE
jackson-databind has @JsonView bypass for setterless creator properties 1 CVE
CVE-2026-54517 CWE-863 EPSS 0.3% Grype
jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields 1 CVE
CVE-2026-54516 CWE-915 EPSS 0.3% Grype
jackson-databind has a @JsonView bypass for unwrapped creator parameters 1 CVE
CVE-2026-54518 CWE-863 EPSS 0.3% Grype
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy 1 CVE
CVE-2026-59888 CWE-915 EPSS 0.2% Grype
Server-Side Request Forgery 1 CVE
CVE-2026-54514 CWE-918 EPSS 0.2% Grype
jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)` 1 CVE
jackson-databind 3.1.4 library 📦 FasterXML
Source: maven_pom		 Apache-2.0 1 6.5 Medium
Deserialization of Untrusted Data 1 CVE
CVE-2026-59889 CWE-863 EPSS 0.3% Grype
jackson-databind 2.22.0 library 📦 FasterXML
Source: existing		 Apache-2.0 2 6.5 Medium
Deserialization of Untrusted Data 2 CVEs
CVE-2026-59889 CWE-863 EPSS 0.3% Grype CVE-2026-54515 CWE-915 EPSS 0.3% Grype
commons-lang3 3.14.0 library 📦 Apache
Source: existing		 Apache-2.0 1 6.5 Medium
Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs 1 CVE
CVE-2025-48924 CWE-674 EPSS 2.3% Grype
jackson-core 2.9.6 library 📦 FasterXML
Source: existing		 Apache-2.0 3 4.0 Medium
jackson-core can throw a StackoverflowError when processing deeply nested data 1 CVE
CVE-2025-52999 CWE-121 EPSS 0.7% Grype
Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation 1 CVE
CVE-2025-49128 CWE-209 EPSS 0.3% Grype
Other vulnerabilities 1 CVE
jackson-core 3.1.1 library 📦 Tatu Saloranta
Source: registry_cache:maven_pom		 Apache-2.0 1 0.9 Low
Other vulnerabilities 1 CVE
jackson-core 2.21.2 library 📦 FasterXML
Source: existing		 Apache-2.0 1 0.9 Low
Other vulnerabilities 1 CVE
log4j-api 2.25.4 library 📦 Apache
Source: existing		 Apache-2.0 1 0.0 Low
Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization 1 CVE
CVE-2026-49844 CWE-116 EPSS 0.6% Grype
commons-exec 1.6.0 library 📦 Apache
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-starter-validation 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-starter 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-starter-logging 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
logback-classic 1.5.34 library 📦 QOS.ch
Source: existing		 EPL-1.0 OR LGPL-2.1 0 0.0 No CVEs None
logback-core 1.5.34 library 📦 QOS.ch
Source: existing		 EPL-1.0 OR LGPL-2.1 0 0.0 No CVEs None
slf4j-api 2.0.18 library 📦 QOS.ch
Source: existing		 MIT 0 0.0 No CVEs None
log4j-to-slf4j 2.25.4 library 📦 Apache
Source: existing		 Apache-2.0 0 0.0 No CVEs None
jul-to-slf4j 2.0.18 library 📦 QOS.ch
Source: existing		 MIT 0 0.0 No CVEs None
spring-boot-autoconfigure 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-core 7.0.8 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
commons-logging 1.3.5 library 📦 Apache
Source: maven_group		 Apache-2.0 0 0.0 No CVEs None
jspecify 1.0.0 library 📦 Kevin Bourrillion
Source: maven_pom		 Unknown 0 0.0 No CVEs None
spring-context 7.0.8 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-aop 7.0.8 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-beans 7.0.8 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-expression 7.0.8 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
micrometer-observation 1.16.6 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
jakarta.annotation-api 3.0.0 library 📦 Eclipse Foundation
Source: existing		 EPL-2.0 0 0.0 No CVEs None
snakeyaml 2.6 library 📦 SnakeYAML
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-validation 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
tomcat-embed-el 11.0.22 library 📦 Apache
Source: existing		 Apache-2.0 0 0.0 No CVEs None
hibernate-validator 9.1.0.Final library 📦 Red Hat
Source: existing		 LGPL-2.1 0 0.0 No CVEs None
jakarta.validation-api 3.1.1 library 📦 Eclipse Foundation
Source: existing		 EPL-2.0 0 0.0 No CVEs None
jboss-logging 3.6.1.Final library 📦 Red Hat
Source: existing		 Apache-2.0 0 0.0 No CVEs None
classmate 1.7.1 library 📦 FasterXML
Source: existing		 Apache-2.0 0 0.0 No CVEs None
lombok 1.18.46 library 📦 Project Lombok
Source: maven_group		 MIT 0 0.0 No CVEs None
jaxb-api 2.3.1 library 📦 Oracle
Source: maven_group		 CDDL-1.1 0 0.0 No CVEs None
javax.activation-api 1.2.0 library 🏢 Maven Community
Source: ecosystem		 CDDL-1.1 0 0.0 No CVEs None
spring-boot-starter-webmvc 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-starter-jackson 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-jackson 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
jackson-annotations 2.21 library 📦 FasterXML
Source: existing		 Apache-2.0 0 0.0 No CVEs None
jackson-core 3.1.4 library 📦 Tatu Saloranta
Source: maven_pom		 Apache-2.0 0 0.0 No CVEs None
spring-boot-starter-tomcat 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-starter-tomcat-runtime 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-tomcat 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-web-server 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-web 7.0.8 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
tomcat-embed-core 11.0.22 library 📦 Apache
Source: existing		 Apache-2.0 0 0.0 No CVEs None
tomcat-annotations-api 11.0.22 library 📦 Apache
Source: existing		 Apache-2.0 0 0.0 No CVEs None
tomcat-embed-websocket 11.0.22 library 📦 Apache
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-http-converter 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
micrometer-commons 1.16.6 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-webmvc 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-servlet 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-webmvc 7.0.8 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
jackson-datatype-jsr310 Unresolved
No artifact version evidence		 library 📦 FasterXML
Source: existing		 Apache-2.0 0 0.0 Not analyzed no resolvable version — cannot evaluate CVE version ranges
spring-boot-starter-actuator 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-starter-micrometer-metrics 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-micrometer-metrics 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-micrometer-observation 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
micrometer-observation 1.17.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
micrometer-commons 1.17.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
micrometer-core 1.17.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
HdrHistogram 2.2.2 library 📦 HdrHistogram
Source: maven_group		 Unknown 0 0.0 No CVEs None
spring-boot-actuator-autoconfigure 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-actuator 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-health 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
micrometer-jakarta9 1.17.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
flyway-core 12.4.0 library 📦 Redgate
Source: maven_group		 Apache-2.0 0 0.0 No CVEs None
lombok 1.18.44 library 📦 Project Lombok
Source: maven_group		 MIT 0 0.0 No CVEs None
flyway-database-hsqldb 12.4.0 library 📦 Redgate
Source: maven_group		 Apache-2.0 0 0.0 No CVEs None
asciidoctorj 3.0.1 library 📦 Asciidoctor
Source: maven_group		 Apache-2.0 0 0.0 No CVEs None
asciidoctorj-api 3.0.1 library 📦 Asciidoctor
Source: maven_group		 Apache-2.0 0 0.0 No CVEs None
jruby 9.4.14 library 📦 JRuby
Source: maven_group		 EPL-2.0 OR GPL-2.0-only OR LGPL-2.1-only 0 0.0 No CVEs None
jruby-base 9.4.14 library 📦 JRuby
Source: maven_group		 EPL-2.0 OR GPL-2.0-only OR LGPL-2.1-only 0 0.0 No CVEs None
asm 9.7.1 library 📦 OW2 Consortium
Source: maven_group		 BSD-3-Clause
MAVEN		 0 0.0 No CVEs None
asm-commons 9.7.1 library 📦 OW2 Consortium
Source: maven_group		 BSD-3-Clause
MAVEN		 0 0.0 No CVEs None
asm-tree 9.7.1 library 📦 OW2 Consortium
Source: maven_group		 BSD-3-Clause 0 0.0 No CVEs None
asm-util 9.7.1 library 📦 OW2 Consortium
Source: maven_group		 BSD-3-Clause 0 0.0 No CVEs None
asm-analysis 9.7.1 library 📦 OW2 Consortium
Source: maven_group		 BSD-3-Clause
MAVEN		 0 0.0 No CVEs None
jnr-netdb 1.2.0 library 📦 Wayne Meissner
Source: maven_pom		 The Apache Software License, Version 2.0
MAVEN		 0 0.0 No CVEs None
jnr-ffi 2.2.0 library 📦 Wayne Meissner
Source: maven_pom		 The Apache Software License, Version 2.0
MAVEN		 0 0.0 No CVEs None
jffi 1.3.0 library 📦 Wayne Meissner
Source: maven_pom		 The Apache Software License, Version 2.0
MAVEN		 0 0.0 No CVEs None
asm 7.1 library 📦 OW2 Consortium
Source: maven_group		 BSD-3-Clause 0 0.0 No CVEs None
asm-commons 7.1 library 📦 OW2 Consortium
Source: maven_group		 BSD-3-Clause
MAVEN		 0 0.0 No CVEs None
asm-analysis 7.1 library 📦 OW2 Consortium
Source: maven_group		 BSD-3-Clause
MAVEN		 0 0.0 No CVEs None
asm-tree 7.1 library 📦 OW2 Consortium
Source: maven_group		 BSD-3-Clause
MAVEN		 0 0.0 No CVEs None
asm-util 7.1 library 📦 OW2 Consortium
Source: maven_group		 BSD-3-Clause
MAVEN		 0 0.0 No CVEs None
jnr-a64asm 1.0.0 library 📦 ossdev
Source: maven_pom		 The Apache Software License, Version 2.0
MAVEN		 0 0.0 No CVEs None
jnr-x86asm 1.0.2 library 📦 Wayne Meissner
Source: maven_pom		 MIT
MAVEN		 0 0.0 No CVEs None
jnr-enxio 0.32.18 library 📦 Wayne Meissner
Source: maven_pom		 Apache-2.0 0 0.0 No CVEs None
jnr-constants 0.10.4 library 📦 Wayne Meissner
Source: maven_pom		 The Apache Software License, Version 2.0
MAVEN		 0 0.0 No CVEs None
jnr-ffi 2.2.17 library 📦 Wayne Meissner
Source: registry_cache:maven_pom		 Apache-2.0 0 0.0 No CVEs None
jffi 1.3.13 library 📦 Wayne Meissner
Source: registry_cache:maven_pom		 The Apache Software License, Version 2.0
MAVEN		 0 0.0 No CVEs None
jnr-unixsocket 0.38.23 library 📦 Wayne Meissner
Source: maven_pom		 Apache-2.0 0 0.0 No CVEs None
jnr-posix 3.1.20 library 📦 Thomas E Enebo
Source: maven_pom		 Eclipse Public License - v 2.0
MAVEN		 0 0.0 No CVEs None
joni 2.2.5 library 📦 JRuby
Source: maven_group		 MIT 0 0.0 No CVEs None
jcodings 1.0.63 library 📦 JRuby
Source: maven_group		 MIT
MAVEN		 0 0.0 No CVEs None
dirgra 0.3 library 📦 JRuby
Source: maven_group		 EPL
MAVEN		 0 0.0 No CVEs None
invokebinder 1.13 library 📦 Charles Nutter
Source: maven_pom		 The Apache Software License, Version 2.0
MAVEN		 0 0.0 No CVEs None
options 1.6 library 📦 Charles Nutter
Source: maven_pom		 The Apache Software License, Version 2.0
MAVEN		 0 0.0 No CVEs None
jzlib 1.1.5 library 📦 JRuby
Source: maven_group		 BSD-3-Clause
MAVEN		 0 0.0 No CVEs None
joda-time 2.12.7 library 📦 Joda.org
Source: maven_pom		 Apache-2.0
MAVEN		 0 0.0 No CVEs None
jitescript 0.4.1 library 📦 Douglas Campos
Source: maven_pom		 Unknown 0 0.0 No CVEs None
asm-all 5.0.1 library 📦 OW2 Consortium
Source: maven_group		 BSD-3-Clause 0 0.0 No CVEs None
backport9 1.13 library 📦 Charles Nutter
Source: maven_pom		 The Apache Software License, Version 2.0
MAVEN		 0 0.0 No CVEs None
crac 1.5.0 library 📦 Anton Kozlov
Source: maven_pom		 BSD-2-Clause
MAVEN		 0 0.0 No CVEs None
jruby-stdlib 9.4.14 library 📦 JRuby
Source: maven_group		 EPL-2.0 OR GPL-2.0-only OR LGPL-2.1-only 0 0.0 No CVEs None
spring-boot-starter-data-jpa 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-starter-jdbc 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-jdbc 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-sql 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-transaction 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-persistence 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-tx 7.0.8 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-jdbc 7.0.8 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
HikariCP 7.0.2 library 📦 Zaxxer
Source: existing		 Apache-2.0 0 0.0 No CVEs None
slf4j-api 2.0.17 library 📦 QOS.ch
Source: existing		 MIT 0 0.0 No CVEs None
spring-boot-data-jpa 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-data-commons 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-data-commons 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-hibernate 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-jpa 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
jakarta.persistence-api 3.2.0 library 📦 Eclipse Foundation
Source: existing		 EPL-2.0 0 0.0 No CVEs None
spring-orm 7.0.8 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
hibernate-core 7.4.1.Final library 📦 Red Hat
Source: existing		 LGPL-2.1 0 0.0 No CVEs None
jakarta.transaction-api 2.0.1 library 📦 Eclipse Foundation
Source: existing		 EPL-2.0 0 0.0 No CVEs None
hibernate-models 1.1.1 library 📦 Red Hat
Source: existing		 LGPL-2.1 0 0.0 No CVEs None
jboss-logging 3.6.3.Final library 📦 Red Hat
Source: existing		 Apache-2.0 0 0.0 No CVEs None
jakarta.xml.bind-api 4.0.4 library 📦 Eclipse Foundation
Source: existing		 EPL-2.0 0 0.0 No CVEs None
jakarta.activation-api 2.1.4 library 📦 Eclipse Foundation
Source: existing		 EPL-2.0 0 0.0 No CVEs None
jaxb-runtime 4.0.7 library 📦 Eclipse Foundation
Source: existing		 EPL-2.0 0 0.0 No CVEs None
jakarta.inject-api 2.0.1 library 📦 Eclipse Foundation
Source: existing		 EPL-2.0 0 0.0 No CVEs None
antlr4-runtime 4.13.2 library 📦 ANTLR
Source: existing		 BSD-3-Clause 0 0.0 No CVEs None
spring-data-jpa 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
jakarta.annotation-api 2.0.0 library 📦 Eclipse Foundation
Source: existing		 EPL-2.0 0 0.0 No CVEs None
spring-aspects 7.0.8 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
aspectjweaver 1.9.25 library 📦 Eclipse Foundation
Source: existing		 EPL-1.0 0 0.0 No CVEs None
spring-boot-starter-security 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-security 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-security-config 7.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-security-core 7.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-security-crypto 7.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-security-web 7.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-starter-thymeleaf 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-thymeleaf 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
thymeleaf-spring6 3.1.5.RELEASE library 📦 Thymeleaf
Source: maven_group		 Apache-2.0 0 0.0 No CVEs None
thymeleaf 3.1.5.RELEASE library 📦 Thymeleaf
Source: maven_group		 Apache-2.0
NPM		 0 0.0 No CVEs None
ognl 3.3.4 library 📦 OpenSymphony
Source: maven_pom		 The Apache Software License, Version 2.0
MAVEN		 0 0.0 No CVEs None
javassist 3.29.0 library 📦 Shigeru Chiba, www.javassist.org
Source: maven_pom		 MPL 1.1
MAVEN		 0 0.0 No CVEs None
attoparser 2.0.7.RELEASE library 📦 The ATTOPARSER team
Source: maven_pom		 The Apache Software License, Version 2.0
MAVEN		 0 0.0 No CVEs None
unbescape 1.1.6.RELEASE library 📦 The UNBESCAPE team
Source: maven_pom		 The Apache Software License, Version 2.0
MAVEN		 0 0.0 No CVEs None
spring-boot-starter-security-oauth2-client 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-security-oauth2-client 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-security-oauth2-client 7.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-security-oauth2-core 7.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
oauth2-oidc-sdk 11.37.2 library 📦 Connect2id
Source: maven_group		 Apache-2.0 0 0.0 No CVEs None
jcip-annotations 1.0 library 📦 Stephen Connolly
Source: maven_pom		 Unknown 0 0.0 No CVEs None
content-type 2.3 library 📦 Connect2id
Source: maven_group		 MIT
NPM		 0 0.0 No CVEs None
json-smart 2.6.0 library 📦 Uriel Chemouni
Source: maven_group		 GPL-3.0-only
NPM		 0 0.0 No CVEs None
accessors-smart 2.6.0 library 📦 Uriel Chemouni
Source: maven_group		 Apache-2.0 0 0.0 No CVEs None
lang-tag 1.7 library 📦 Connect2id
Source: maven_group		 MIT
NPM		 0 0.0 No CVEs None
nimbus-jose-jwt 10.9 library 📦 Connect2id
Source: maven_group		 Apache-2.0 0 0.0 No CVEs None
spring-security-oauth2-jose 7.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
thymeleaf-extras-springsecurity6 3.1.5.RELEASE library 📦 Thymeleaf
Source: maven_group		 Apache-2.0 0 0.0 No CVEs None
jakarta.servlet-api 6.1.0 library 📦 Eclipse Foundation
Source: existing		 EPL-2.0 0 0.0 No CVEs None
hsqldb 2.7.3 library 📦 HSQLDB Group
Source: maven_group		 HSQLDB License, a BSD open source license
MAVEN		 0 0.0 No CVEs None
jsoup 1.23.1 library 📦 jsoup
Source: maven_group		 ISC
NPM		 0 0.0 No CVEs None
zxcvbn 1.9.0 library 📦 Nulab
Source: maven_group		 MIT
MAVEN		 0 0.0 No CVEs None
xmlpull 1.1.3.1 library 🏢 Maven Community
Source: ecosystem		 CC0-1.0
MAVEN		 0 0.0 No CVEs None
xpp3_min 1.1.4c library 📦 Extreme! Lab, Indiana University
Source: maven_pom		 Unknown 0 0.0 No CVEs None
jmock 1.0.1 library 🏢 Maven Community
Source: ecosystem		 MIT
NPM		 0 0.0 No CVEs None
cglib-nodep 3.3.0 library 📦 CGLIB
Source: maven_group		 Apache-2.0 0 0.0 No CVEs None
xml-resolver 1.2 library 📦 Apache
Source: maven_group		 Apache-2.0 0 0.0 No CVEs None
jjwt 0.9.1 library 📦 JJWT Project
Source: maven_group		 Apache-2.0
MAVEN		 0 0.0 No CVEs None
jackson-annotations 2.9.0 library 📦 FasterXML
Source: existing		 Apache-2.0 0 0.0 No CVEs None
jwks-rsa 0.24.1 library 📦 Auth0
Source: maven_group		 MIT
NPM		 0 0.0 No CVEs None
guava 33.6.0 library 📦 Google
Source: existing		 Apache-2.0 0 0.0 No CVEs None
failureaccess 1.0.3 library 📦 Google
Source: existing		 Apache-2.0 0 0.0 No CVEs None
listenablefuture 9999.0 library 📦 Google
Source: existing		 Apache-2.0 0 0.0 No CVEs None
error_prone_annotations 2.47.0 library 📦 Google
Source: existing		 Apache-2.0 0 0.0 No CVEs None
j2objc-annotations 3.1 library 📦 Google
Source: existing		 Apache-2.0 0 0.0 No CVEs None
java-jwt 4.6.0 library 📦 Auth0
Source: maven_group		 MIT 0 0.0 No CVEs None
jackson-core 2.22.0 library 📦 FasterXML
Source: existing		 Apache-2.0 0 0.0 No CVEs None
jackson-annotations 2.22 library 📦 FasterXML
Source: existing		 Apache-2.0 0 0.0 No CVEs None
commons-io 2.22.0 library 📦 Apache
Source: maven_group		 Apache-2.0 0 0.0 No CVEs None
commons-text 1.15.0 library 📦 Apache
Source: existing		 Apache-2.0 0 0.0 No CVEs None
commons-lang3 3.20.0 library 📦 Apache
Source: existing		 Apache-2.0 0 0.0 No CVEs None
jose4j 0.9.6 library 📦 Brian Campbell
Source: maven_group		 The Apache Software License, Version 2.0
MAVEN		 0 0.0 No CVEs None
slf4j-api 1.7.36 library 📦 QOS.ch
Source: existing		 MIT 0 0.0 No CVEs None
bootstrap 5.3.5 library 📦 WebJars
Source: maven_group		 Apache-2.0
MAVEN		 0 0.0 No CVEs None
jquery 4.0.0 library 📦 WebJars
Source: maven_group		 MIT
NPM		 0 0.0 No CVEs None
webjars-locator-lite 1.1.4 library 📦 WebJars
Source: maven_group		 MIT 0 0.0 No CVEs None
jakarta.xml.bind-api 4.0.5 library 📦 Eclipse Foundation
Source: existing		 EPL-2.0 0 0.0 No CVEs None
jaxb-impl 4.0.9 library 📦 Oracle
Source: maven_group		 CDDL-1.1 0 0.0 No CVEs None
jaxb-core 4.0.9 library 📦 Oracle
Source: maven_group		 BSD-3-Clause 0 0.0 No CVEs None
spring-boot-properties-migrator 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None
spring-boot-configuration-metadata 4.1.0 library 📦 VMware
Source: existing		 Apache-2.0 0 0.0 No CVEs None

Report Generation Details

Technical Details

Generated: 2026-08-24 11:36:27

Source File: WebGoat_20260824.json

Enhancement: ESL SBOMator with OSV.dev online cross-check

Report Type: Full (with CVE analysis)

Vulnerability Database

CISA KEV Integration: Active Exploitation Detection

Processing: Local Database (Fast)

Coverage: 2015-2025

FDA/NTIA Compliance
📋 Supplier Field Coverage: 199/202 components (98.5%)
FDA requires supplier identification for medical device SBOM submissions

Secret Exposure Scan

23 potential secret(s) detected. Scanner: gitleaks (8.30.1)
Production findings: 14 / 23 — production: 14 | test_fixture: 9
Rule Description File:Line Risk Rank
generic-api-keyDetected a Generic API Key, potentially exposing access to various services and sensitive operations.src/main/java/org/owasp/webgoat/lessons/challenges/challenge7/Assignment7.java:362 Production
private-keyIdentified a Private Key, which may compromise cryptographic security and sensitive data encryption.src/main/java/org/owasp/webgoat/lessons/cryptography/CryptoUtil.java:49-562 Production
private-keyIdentified a Private Key, which may compromise cryptographic security and sensitive data encryption.src/main/java/org/owasp/webgoat/lessons/cryptography/CryptoUtil.java:137-1382 Production
generic-api-keyDetected a Generic API Key, potentially exposing access to various services and sensitive operations.src/main/java/org/owasp/webgoat/lessons/jwt/JWTRefreshEndpoint.java:452 Production
generic-api-keyDetected a Generic API Key, potentially exposing access to various services and sensitive operations.src/main/java/org/owasp/webgoat/lessons/jwt/JWTRefreshEndpoint.java:462 Production
generic-api-keyDetected a Generic API Key, potentially exposing access to various services and sensitive operations.src/main/java/org/owasp/webgoat/lessons/securitymisconfiguration/ActuatorExposureTask.java:282 Production
jwtUncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.src/main/resources/lessons/jwt/documentation/JWT_libraries.adoc:282 Production
jwtUncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.src/main/resources/lessons/jwt/documentation/JWT_libraries.adoc:402 Production
jwtUncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.src/main/resources/lessons/jwt/documentation/JWT_libraries.adoc:562 Production
jwtUncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.src/main/resources/lessons/jwt/documentation/JWT_libraries_assignment.adoc:72 Production
generic-api-keyDetected a Generic API Key, potentially exposing access to various services and sensitive operations.src/main/resources/lessons/jwt/documentation/JWT_refresh.adoc:322 Production
jwtUncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.src/main/resources/lessons/jwt/documentation/JWT_signing_solution.adoc:352 Production
jwtUncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.src/main/resources/lessons/jwt/images/logs.txt:22 Production
generic-api-keyDetected a Generic API Key, potentially exposing access to various services and sensitive operations.src/main/resources/lessons/jwt/js/jwt-refresh.js:102 Production
jwtUncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.src/it/java/org/owasp/webgoat/playwright/webwolf/JwtUITest.java:311 Test Fixture
jwtUncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.src/test/java/org/owasp/webgoat/lessons/jwt/JWTRefreshEndpointTest.java:551 Test Fixture
jwtUncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.src/test/java/org/owasp/webgoat/lessons/jwt/JWTRefreshEndpointTest.java:1011 Test Fixture
jwtUncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.src/test/java/org/owasp/webgoat/lessons/jwt/JWTRefreshEndpointTest.java:1131 Test Fixture
jwtUncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.src/test/java/org/owasp/webgoat/lessons/jwt/claimmisuse/JWTHeaderKIDEndpointTest.java:261 Test Fixture
generic-api-keyDetected a Generic API Key, potentially exposing access to various services and sensitive operations.src/test/java/org/owasp/webgoat/lessons/jwt/claimmisuse/JWTHeaderKIDEndpointTest.java:681 Test Fixture
jwtUncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.src/test/java/org/owasp/webgoat/webwolf/jwt/JWTTokenTest.java:401 Test Fixture
jwtUncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.src/test/java/org/owasp/webgoat/webwolf/jwt/JWTTokenTest.java:541 Test Fixture
jwtUncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.src/test/java/org/owasp/webgoat/webwolf/jwt/JWTTokenTest.java:651 Test Fixture

🎯 Top Actionable Risks

Unified 0-100 risk score = CVSS severity × exploit likelihood (KEV/EPSS) × applicability (reachability, VEX state, deployment scope). Ranks the findings most worth acting on first.

RiskPriorityCVEComponentWhy it ranks here
100 Critical CVE-2018-14721 maven/com.fasterxml.jackson.core/jackson-databind@2.9.6 CVSS baseline Critical · Reachability unknown
98 Critical CVE-2013-7285 maven/com.thoughtworks.xstream/xstream@1.4.5 CVSS baseline Critical · Reachability unknown
98 Critical CVE-2018-14718 maven/com.fasterxml.jackson.core/jackson-databind@2.9.6 CVSS baseline Critical · Reachability unknown
98 Critical CVE-2018-14719 maven/com.fasterxml.jackson.core/jackson-databind@2.9.6 CVSS baseline Critical · Reachability unknown
98 Critical CVE-2018-14720 maven/com.fasterxml.jackson.core/jackson-databind@2.9.6 CVSS baseline Critical · Reachability unknown
98 Critical CVE-2018-19360 maven/com.fasterxml.jackson.core/jackson-databind@2.9.6 CVSS baseline Critical · Reachability unknown
98 Critical CVE-2018-19361 maven/com.fasterxml.jackson.core/jackson-databind@2.9.6 CVSS baseline Critical · Reachability unknown
98 Critical CVE-2018-19362 maven/com.fasterxml.jackson.core/jackson-databind@2.9.6 CVSS baseline Critical · Reachability unknown
98 Critical CVE-2019-14379 maven/com.fasterxml.jackson.core/jackson-databind@2.9.6 CVSS baseline Critical · Reachability unknown
98 Critical CVE-2019-14540 maven/com.fasterxml.jackson.core/jackson-databind@2.9.6 CVSS baseline Critical · Reachability unknown

Showing top 10 of 126 scored findings. Toggle above re-selects the top 10 by reachability.

🏥 VEX - Vulnerability Exploitability Assessment

FDA Compliance: Patient harm assessment and mitigation timelines documented per FDA Section 524B(b)(1)

127

Total Vulnerabilities Assessed

1

Affected (Require Action)

0

Not Affected

0

Unreachable (Not Imported)

Unreachable = present in the dependency set but not imported/used by first-party source code (entry-point reachability analysis). These remain in the SBOM for compliance completeness; the count is a subset of Not Affected.

VEX Assessments:
CVE-2021-39144 ⚠️ AFFECTED

HIGH PRIORITY: xstream is actively exploited in the wild (CISA KEV). Severity: HIGH (CVSS 8.5). Update recommended within 48 hours.


Patient Harm: High
Mitigation Target: 2026-09-23
CVE-2013-7285 🔍 UNDER INVESTIGATION

Runtime component xstream has a CRITICAL vulnerability (CVSS 9.8); identified but not proven exploitable (no KEV match and reachability not confirmed). Product-specific triage is required before an affected / not_affected determination.


Patient Harm: High
Controls:
• Manual VEX Triage Required: Confirm reachability and device exposure before classifying affected or not_affected
CVE-2020-26217 🔍 UNDER INVESTIGATION

Runtime component xstream has a HIGH vulnerability (CVSS 8.0); identified but not proven exploitable (no KEV match and reachability not confirmed). Product-specific triage is required before an affected / not_affected determination.


Patient Harm: Medium
Controls:
• Manual VEX Triage Required: Confirm reachability and device exposure before classifying affected or not_affected
CVE-2021-21341 🔍 UNDER INVESTIGATION

Runtime component xstream has a HIGH vulnerability (CVSS 7.5); identified but not proven exploitable (no KEV match and reachability not confirmed). Product-specific triage is required before an affected / not_affected determination.


Patient Harm: Medium
Controls:
• Manual VEX Triage Required: Confirm reachability and device exposure before classifying affected or not_affected
CVE-2021-29505 🔍 UNDER INVESTIGATION

Runtime component xstream has a HIGH vulnerability (CVSS 7.5); identified but not proven exploitable (no KEV match and reachability not confirmed). Product-specific triage is required before an affected / not_affected determination.


Patient Harm: Medium
Controls:
• Manual VEX Triage Required: Confirm reachability and device exposure before classifying affected or not_affected
CVE-2020-26259 🔍 UNDER INVESTIGATION

Runtime component xstream has a MEDIUM vulnerability (CVSS 6.8); identified but not proven exploitable (no KEV match and reachability not confirmed). Product-specific triage is required before an affected / not_affected determination.


Patient Harm: Low
Controls:
• Manual VEX Triage Required: Confirm reachability and device exposure before classifying affected or not_affected
CVE-2020-26258 🔍 UNDER INVESTIGATION

Runtime component xstream has a MEDIUM vulnerability (CVSS 6.3); identified but not proven exploitable (no KEV match and reachability not confirmed). Product-specific triage is required before an affected / not_affected determination.


Patient Harm: Low
Controls:
• Manual VEX Triage Required: Confirm reachability and device exposure before classifying affected or not_affected
CVE-2021-21351 🔍 UNDER INVESTIGATION

Runtime component xstream has a MEDIUM vulnerability (CVSS 5.4); identified but not proven exploitable (no KEV match and reachability not confirmed). Product-specific triage is required before an affected / not_affected determination.


Patient Harm: Low
Controls:
• Manual VEX Triage Required: Confirm reachability and device exposure before classifying affected or not_affected
CVE-2021-21346 🔍 UNDER INVESTIGATION

Runtime component xstream has a MEDIUM vulnerability (CVSS 6.1); identified but not proven exploitable (no KEV match and reachability not confirmed). Product-specific triage is required before an affected / not_affected determination.


Patient Harm: Low
Controls:
• Manual VEX Triage Required: Confirm reachability and device exposure before classifying affected or not_affected
CVE-2021-21344 🔍 UNDER INVESTIGATION

Runtime component xstream has a MEDIUM vulnerability (CVSS 5.3); identified but not proven exploitable (no KEV match and reachability not confirmed). Product-specific triage is required before an affected / not_affected determination.


Patient Harm: Low
Controls:
• Manual VEX Triage Required: Confirm reachability and device exposure before classifying affected or not_affected

Complete VEX document: WebGoat_20260824_VEX.json

Dependency Analysis

203
Graph nodes
202
Direct dependencies
0
Transitive dependencies
1
Maximum depth
0
Multiple parents
11
Vulnerable paths
Vulnerable dependency paths
  1. WebGoat → jackson-databind
  2. WebGoat → jackson-databind
  3. WebGoat → jackson-databind
  4. WebGoat → jackson-databind
  5. WebGoat → xstream
  6. WebGoat → log4j-api
  7. WebGoat → jackson-core
  8. WebGoat → jackson-core
  9. WebGoat → jackson-databind
  10. WebGoat → commons-lang3
  11. WebGoat → jackson-core

Interactive SBOM Dependency Graph

Interactive SBOM Dependency Graph (static fallback)

Interactive graph unavailable. Nodes:

  • WebGoat (application)
  • commons-exec (library)
  • spring-boot-starter-validation (library)
  • spring-boot-starter (library)
  • spring-boot-starter-logging (library)
  • logback-classic (library)
  • logback-core (library)
  • slf4j-api (library)
  • log4j-to-slf4j (library)
  • log4j-api (library)
  • jul-to-slf4j (library)
  • spring-boot-autoconfigure (library)
  • spring-boot (library)
  • spring-core (library)
  • commons-logging (library)
  • jspecify (library)
  • spring-context (library)
  • spring-aop (library)
  • spring-beans (library)
  • spring-expression (library)
  • micrometer-observation (library)
  • jakarta.annotation-api (library)
  • snakeyaml (library)
  • spring-boot-validation (library)
  • tomcat-embed-el (library)
  • hibernate-validator (library)
  • jakarta.validation-api (library)
  • jboss-logging (library)
  • classmate (library)
  • lombok (library)
  • jaxb-api (library)
  • javax.activation-api (library)
  • spring-boot-starter-webmvc (library)
  • spring-boot-starter-jackson (library)
  • spring-boot-jackson (library)
  • jackson-databind (library)
  • jackson-annotations (library)
  • jackson-core (library)
  • spring-boot-starter-tomcat (library)
  • spring-boot-starter-tomcat-runtime (library)
  • spring-boot-tomcat (library)
  • spring-boot-web-server (library)
  • spring-web (library)
  • tomcat-embed-core (library)
  • tomcat-annotations-api (library)
  • tomcat-embed-websocket (library)
  • spring-boot-http-converter (library)
  • micrometer-commons (library)
  • spring-boot-webmvc (library)
  • spring-boot-servlet (library)
  • spring-webmvc (library)
  • jackson-datatype-jsr310 (library)
  • spring-boot-starter-actuator (library)
  • spring-boot-starter-micrometer-metrics (library)
  • spring-boot-micrometer-metrics (library)
  • spring-boot-micrometer-observation (library)
  • micrometer-observation (library)
  • micrometer-commons (library)
  • micrometer-core (library)
  • HdrHistogram (library)
  • spring-boot-actuator-autoconfigure (library)
  • spring-boot-actuator (library)
  • spring-boot-health (library)
  • micrometer-jakarta9 (library)
  • flyway-core (library)
  • lombok (library)
  • jackson-databind (library)
  • jackson-core (library)
  • flyway-database-hsqldb (library)
  • asciidoctorj (library)
  • asciidoctorj-api (library)
  • jruby (library)
  • jruby-base (library)
  • asm (library)
  • asm-commons (library)
  • asm-tree (library)
  • asm-util (library)
  • asm-analysis (library)
  • jnr-netdb (library)
  • jnr-ffi (library)
  • jffi (library)
  • asm (library)
  • asm-commons (library)
  • asm-analysis (library)
  • asm-tree (library)
  • asm-util (library)
  • jnr-a64asm (library)
  • jnr-x86asm (library)
  • jnr-enxio (library)
  • jnr-constants (library)
  • jnr-ffi (library)
  • jffi (library)
  • jnr-unixsocket (library)
  • jnr-posix (library)
  • joni (library)
  • jcodings (library)
  • dirgra (library)
  • invokebinder (library)
  • options (library)
  • jzlib (library)
  • joda-time (library)
  • jitescript (library)
  • asm-all (library)
  • backport9 (library)
  • crac (library)
  • jruby-stdlib (library)
  • spring-boot-starter-data-jpa (library)
  • spring-boot-starter-jdbc (library)
  • spring-boot-jdbc (library)
  • spring-boot-sql (library)
  • spring-boot-transaction (library)
  • spring-boot-persistence (library)
  • spring-tx (library)
  • spring-jdbc (library)
  • HikariCP (library)
  • slf4j-api (library)
  • spring-boot-data-jpa (library)
  • spring-boot-data-commons (library)
  • spring-data-commons (library)
  • spring-boot-hibernate (library)
  • spring-boot-jpa (library)
  • jakarta.persistence-api (library)
  • spring-orm (library)
  • hibernate-core (library)
  • jakarta.transaction-api (library)
  • hibernate-models (library)
  • jboss-logging (library)
  • jakarta.xml.bind-api (library)
  • jakarta.activation-api (library)
  • jaxb-runtime (library)
  • jakarta.inject-api (library)
  • antlr4-runtime (library)
  • spring-data-jpa (library)
  • jakarta.annotation-api (library)
  • spring-aspects (library)
  • aspectjweaver (library)
  • spring-boot-starter-security (library)
  • spring-boot-security (library)
  • spring-security-config (library)
  • spring-security-core (library)
  • spring-security-crypto (library)
  • spring-security-web (library)
  • spring-boot-starter-thymeleaf (library)
  • spring-boot-thymeleaf (library)
  • thymeleaf-spring6 (library)
  • thymeleaf (library)
  • ognl (library)
  • javassist (library)
  • attoparser (library)
  • unbescape (library)
  • spring-boot-starter-security-oauth2-client (library)
  • spring-boot-security-oauth2-client (library)
  • spring-security-oauth2-client (library)
  • spring-security-oauth2-core (library)
  • oauth2-oidc-sdk (library)
  • jcip-annotations (library)
  • content-type (library)
  • json-smart (library)
  • accessors-smart (library)
  • lang-tag (library)
  • nimbus-jose-jwt (library)
  • spring-security-oauth2-jose (library)
  • thymeleaf-extras-springsecurity6 (library)
  • jakarta.servlet-api (library)
  • hsqldb (library)
  • jsoup (library)
  • zxcvbn (library)
  • xstream (library)
  • xmlpull (library)
  • xpp3_min (library)
  • jmock (library)
  • cglib-nodep (library)
  • xml-resolver (library)
  • jjwt (library)
  • jackson-databind (library)
  • jackson-annotations (library)
  • jackson-core (library)
  • jwks-rsa (library)
  • jackson-databind (library)
  • jackson-core (library)
ESL SBOMator

Professional SBOM Solution

Engineering Software Lab

Security & Compliance Tools

Contact Information

www.eswlab.com
sales@eswlab.com

Report generated by ESL SBOMator v1.4.2

Dependency Filtering Diagnostics

Scope mode: runtime-only

Original components: 205

Retained components: 202

Removed components: 3 (1%)

ClassificationCount
build_components3
runtime_components202
unknown_components0
Filter version: 1.0 · 2026-08-24T11:30:52.616096