<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

<modelVersion>4.0.0</modelVersion>

<groupId>org.cysecurity</groupId>

<artifactId>JavaVulnerableLab</artifactId>

<packaging>war</packaging>

<version>0.0.1-SNAPSHOT</version>

<name>JavaVulnerableLab Maven Webapp</name>

<url>http://maven.apache.org</url>

<dependencies>

<dependency>

<groupId>junit</groupId>

<artifactId>junit</artifactId>

<version>3.8.1</version>

<scope>test</scope>

</dependency>

<dependency>

<groupId>mysql</groupId>

<artifactId>mysql-connector-java</artifactId>

<version>5.1.26</version>

</dependency>

<dependency>

<groupId>org.json</groupId>

<artifactId>json</artifactId>

<version>20090211</version>

</dependency>

<dependency>

<groupId>javax.servlet</groupId>

<artifactId>jstl</artifactId>

<version>1.2</version>

</dependency>

<dependency>

<groupId>org.hibernate</groupId>

<artifactId>hibernate-core</artifactId>

<version>4.0.1.Final</version>

</dependency>

<dependency>

<groupId>javax.servlet</groupId>

<artifactId>servlet-api</artifactId>

<version>2.3</version>

<scope>provided</scope>

</dependency>

<!-- OWASP 2025 A03 Software Supply Chain: log4j 2.12.1 is the Java 7 branch

and is still vulnerable to Log4Shell (CVE-2021-44228). 2.12.2 fixed it. -->

<dependency>

<groupId>org.apache.logging.log4j</groupId>

<artifactId>log4j-api</artifactId>

<version>2.12.1</version>

</dependency>

<dependency>

<groupId>org.apache.logging.log4j</groupId>

<artifactId>log4j-core</artifactId>

<version>2.12.1</version>

</dependency>

<!-- OWASP 2025 A08 Software or Data Integrity Failures: commons-collections

3.1 (2004) carries the InvokerTransformer gadget used by ysoserial's

CommonsCollections chains. On the classpath it turns the raw

ObjectInputStream in vulnerability/deserialize/preferences.jsp into RCE

(CWE-502). Fixed by upgrading to 3.2.2 + a deserialization allow-list. -->

<dependency>

<groupId>commons-collections</groupId>

<artifactId>commons-collections</artifactId>

<version>3.1</version>

</dependency>

<!-- OWASP 2025 A06 Insecure Design: file upload with no type restriction

(CWE-434). commons-fileupload 1.3.x + commons-io are Java 7 compatible. -->

<dependency>

<groupId>commons-fileupload</groupId>

<artifactId>commons-fileupload</artifactId>

<version>1.3.3</version>

</dependency>

<dependency>

<groupId>commons-io</groupId>

<artifactId>commons-io</artifactId>

<version>2.6</version>

</dependency>

</dependencies>

<build>

<finalName>JavaVulnerableLab</finalName>

</build>

<properties>

<maven.compiler.source>1.7</maven.compiler.source>

<maven.compiler.target>1.7</maven.compiler.target>

</properties>

</project>