Critical
Non-Thread-Safe Shared JDBC Connection
CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization
DatabaseHelper.java:36 declares private static Connection conn — a single java.sql.Connection shared across all concurrent servlet invocations. The JNDI pool is configured for maxTotal=12 connections, but getSqlConnection() lazy-initialises and caches only one, abandoning the remaining 11 slots. Any concurrent DAST scan or multi-threaded crawler will cause transaction interleaving and silent data corruption.
Critical
Keystore File + Hardcoded Password Committed to SCM
CWE-321 — Use of Hard-coded Cryptographic Key
The file .keystore (2,233 bytes, self-signed) is tracked by git. The Cargo deployment configuration in pom.xml:159 hardcodes keystorePass=changeit. Additionally, SonarReport.java:25 hardcodes SONAR_PASSWORD = "P4ssword!!!!". Three independent secrets committed in plaintext across two files.
High
CVE-2023-33201 — BouncyCastle LDAP Injection in X.500 Parsing
CVE-2023-33201 · CWE-90 — LDAP Injection
bcprov-jdk15on:1.70 is affected by CVE-2023-33201. An attacker controlling a certificate subject/issuer DN can inject LDAP filter operators via the X500Name class. CVSS 3.1 score: 5.3 (Medium). Fixed in BouncyCastle ≥ 1.74. The benchmark uses BouncyCastle as a JCE provider (loaded at startup via Security.addProvider() in Startup.java).
High
TLSv1-Only SSL Factory + Disabled Hostname Verification
CWE-326 · CWE-297 — Inadequate Encryption Strength / Certificate Validation Bypass
Utils.getSSLFactory() at line 425 constrains the SSL socket factory to new String[]{"TLSv1"} and uses NoopHostnameVerifier.INSTANCE. TLSv1 is prohibited by RFC 8996 and disabled by default in Java 11+ (jdk.tls.disabledAlgorithms). The crawler (runCrawler.sh) will throw SSLHandshakeException on modern JVMs. NoopHostnameVerifier allows MITM attacks on the crawling infrastructure.
High
EOL Dependency: commons-dbcp 1.4 (Last Release 2013)
CWE-1104 — Use of Unmaintained Third Party Components
commons-dbcp:1.4 reached end-of-life in 2013. It has known connection pool exhaustion bugs, resource leak vulnerabilities, and no security patch channel. The benchmark uses it as the BasicDataSource bean supplying the Spring JdbcTemplate. Successor commons-dbcp2 (now at 2.12.x) has a compatible API and active maintenance.
High
EOL Dependency: Jersey 1.19.4 / JAX-RS 1.x (EOL 2014)
CWE-1104 — Use of Unmaintained Third Party Components
jersey-servlet:1.19.4 implements JAX-RS 1.x and has been unsupported since 2014. The pom.xml acknowledges it is "unused declared" but required at runtime. No security patches are available for the 1.x branch. The successor is jersey-container-servlet-core:3.x (Jakarta EE).
Medium
EOL Dependency: Hibernate ORM 3.6.10.Final (EOL ~2012)
CWE-1104 · LGPL-2.1 Copyleft Risk
Hibernate 3.6.x is a deeply EOL branch (final release ~2012). It carries the LGPL-2.1-only license — the only copyleft dependency in the WAR. Although dynamic linking via classpath is generally LGPL-compatible, any static bundling or redistribution of a modified Hibernate requires source disclosure. Additionally, hibernate-classic.Session API used in HibernateUtil was deprecated in Hibernate 3.x.
Medium
EOL Dependency: commons-lang 2.6 (Final Release 2011)
CWE-1104 — Use of Unmaintained Third Party Components
commons-lang:2.6 final release was in 2011. The active successor is org.apache.commons:commons-lang3 (currently 3.17.x). Unlike commons-dbcp, the package name changes from org.apache.commons.lang.* to org.apache.commons.lang3.*, requiring source-level migration.
Medium
LDAPManager Exception Swallowing in Constructor
CWE-390 — Detection of Error Condition Without Action
LDAPManager.java:52 catches NamingException with only a System.out.println and continues with ctx = null. Every subsequent LDAP call will throw NullPointerException instead of a meaningful diagnostic, masking the root cause and causing all 59 LDAP injection test cases to produce undifferentiated errors when ApacheDS is unavailable.
Medium
SQL Errors Exposed to HTTP Clients
CWE-209 — Generation of Error Message Containing Sensitive Information
DatabaseHelper.java:42 declares public static final boolean hideSQLErrors = false. When set to false, all SQLException stack traces (including table names, column names, SQL syntax) are propagated as ServletException and rendered to HTTP clients. Confirmed by test case pattern: if (DatabaseHelper.hideSQLErrors) { ... } else throw new ServletException(e).
Medium
JAXB Uses Legacy javax.xml.bind Namespace (Not Jakarta)
Technical Debt — Jakarta EE 9+ Incompatibility
jaxb-api:2.3.1 and jaxb-impl:2.3.9 use the javax.xml.bind namespace. Jakarta EE 9+ renamed this to jakarta.xml.bind. Any future migration to Spring 6.x, Hibernate 6.x, or Jakarta EE 10 will require upgrading to jakarta.xml.bind-api:4.0.x simultaneously — a package-rename migration affecting all JAXB-annotated classes (Person.java, XMLMessage.java).
Low
api-ldap-model Pinned Below api-ldap-schema-data (Version Skew)
Supply Chain Risk — Inconsistent dependency versions
api-ldap-model is pinned at 2.1.7 while api-ldap-schema-data uses 2.1.8 (resolved from the ${version.apache.api-ldap} property). The comment in pom.xml explains the pin exists due to upstream bug DIRAPI-433. This version skew between two tightly coupled Apache Directory API modules is a latent compatibility risk that must be revisited when DIRAPI-433 is resolved.
Low
Java 8 Bytecode Target vs. Build-Time Java 11+ Requirement
Compatibility Risk — Runtime/compile-time mismatch
The Maven enforcer requires Java 8 runtime (requireJavaVersion=${java.target}) but the Spotless plugin (Google Java Format 1.17.0) and the enforcer's enforceBytecodeVersion check require Java 11+ to run. The resulting WAR targets Java 8 class files but cannot be built on Java 8 alone — a split requirement that may confuse CI environments or build containers.
Info
Spring Framework 5.x / EOL November 2024
CWE-1104 — Approaching EOL
Spring Framework 5.3.x reached end-of-OSS-support in November 2024. The pom.xml declares spring-*:5.3.39 (the final 5.3 release). Security patches for Spring 5.x will only be available to commercial Spring support subscribers. Spring 6.x requires a Jakarta EE namespace migration (javax.* → jakarta.*) — the same migration chain that affects JAXB, Servlet API, and Hibernate.