<?xml version="1.0" encoding="UTF-8"?>
<report tool_name="marfcat" tool_version="SATE2010.5">
	<weakness id="1" tool_specific_id="1">
		<name cweid="255">Credentials Management (CWE-255)</name>
		<location id="12" line="560" path="apache-tomcat-5.5.13-src/build/tomcat.nsi">
			<fragment>
550:   IfSilent Silent 0
551: 
552:   ; Escape XML
553:   Push $R1
554:   Call xmlEscape
555:   Pop $R1
556:   Push $R2
557:   Call xmlEscape
558:   Pop $R2
559:   
560:   StrCpy $R5 '&lt;user name="$R1" password="$R2" roles="admin,manager" /&gt;'
561: 
562: Silent:
563:   DetailPrint 'HTTP/1.1 Connector configured on port "$R0"'
564:   DetailPrint 'Admin user added: "$R1"'
565: 
566:   SetOutPath $TEMP
567:   File /r confinstall
568: 
569:   ; Build final server.xml
570:   Delete "$INSTDIR\conf\server.xml"

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: sink
SATE: When a user/password is not entered during setup, an administrator
is created with a blank username and password. Fix checks whether variables
$R1 and $R2 are blank.
=====================================

			</explanation>
		</location>
		<grade
			severity="1"
			probability="1.0"
			tool_specific_rank="0.0"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.13-src/build/tomcat.nsi
              Path ID: 12
               Config: -cweid -nopreprep -raw -fft -mink 
      Processing time: 0d:0h:0m:0s:10ms:10ms
         Subject's ID: 255
   Subject identified: CWE-255
ResultSet: Raw ResultSet data:
[[255:0.0:ID=255, outcome=0.0], [22:49.888166878048864:ID=22, outcome=49.888166878048864], [200:25.66795489080057:ID=200, outcome=25.66795489080057], [79:38.979153355016365:ID=79, outcome=38.979153355016365], [20:63.10843808483816:ID=20, outcome=63.10843808483816], [119:53.48119574000898:ID=119, outcome=53.48119574000898], [264:64.17898821793779:ID=264, outcome=64.17898821793779], [16:13.828153488789358:ID=16, outcome=13.828153488789358]]

Sorted data:
([255:0.0:ID=255, outcome=0.0],[16:13.828153488789358:ID=16, outcome=13.828153488789358],[200:25.66795489080057:ID=200, outcome=25.66795489080057],[79:38.979153355016365:ID=79, outcome=38.979153355016365],[22:49.888166878048864:ID=22, outcome=49.888166878048864],[119:53.48119574000898:ID=119, outcome=53.48119574000898],[20:63.10843808483816:ID=20, outcome=63.10843808483816],[264:64.17898821793779:ID=264, outcome=64.17898821793779])
FileItem: strFileID: [12]
strPath: [apache-tomcat-5.5.13-src/build/tomcat.nsi]
strFileType: [Non-ISO extended-ASCII English text; with very long lines]
bEmpty: [false]
oLocations: [[[&lt;&lt;strLineNumber:560,,,
  oCVEs:[CVE-2009-3548],,,
  oCWEs:[CWE: {cweid:CWE-255, name:Credentials Management}: empty: false],,,
  strExplanation:SATE: When a user/password is not entered during setup, an administrator
is created with a blank username and password. Fix checks whether variables
$R1 and $R2 are blank.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:sink,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
]]]

Expected subject's ID: 255 (possible: [255])
     Expected subject: CWE-255
       Second Best ID: 16
     Second Best Name: CWE-16
            Date/time: Sat Sep 11 17:23:19 EDT 2010
Outcome o (classifier-specific): 0.0
             Distance threshold: 0.1
           Computed raw P = 1/o: Infinity
         Warning to be reported: true
          Computed normalized P: 1.0

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="2" tool_specific_id="2">
		<name cweid="20">Input Validation (CWE-20)</name>
		<location id="251" line="270" path="apache-tomcat-5.5.13-src/connectors/jk/java/org/apache/jk/common/HandlerRequest.java">
			<fragment>
260:                 decodeRequest( msg, ep, tmpMB );
261:                 if (twa != null) {
262:                     twa.setCurrentStage(control, "JkService");
263:                     twa.setParam(control,
264:                                  ((Request)ep.getRequest()).unparsedURI());
265:                 }
266:             } catch( Exception ex ) {
267:                 log.error( "Error decoding request ", ex );
268:                 msg.dump( "Incomming message");
269:                 return ERROR;
270:             }
271: 
272:             if( requiredSecret != null ) {
273:                 String epSecret=(String)ep.getNote( secretNote );
274:                 if( epSecret==null || ! requiredSecret.equals( epSecret ) )
275:                     return ERROR;
276:             }
277:             /* XXX it should be computed from request, by workerEnv */
278:             if(log.isDebugEnabled() )
279:                 log.debug("Calling next " + next.getName() + " " +
280:                   next.getClass().getName());
281: 
282:             int err= next.invoke( msg, ep );
283:             if (twa != null) {
284:                 twa.setCurrentStage(control, "JkDone");
285:             }
286: 

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: fix
SATE: A bug in load balancing code allows a denial of service attack through a
crafted request with invalid headers. The fix adds code to properly return a 400 error
(bad request) when this type of message is recieved.
=====================================

			</explanation>
		</location>
		<location id="251" line="266" path="apache-tomcat-5.5.13-src/connectors/jk/java/org/apache/jk/common/HandlerRequest.java">
			<fragment>
256:             try {
257:                 if (twa != null) {
258:                     twa.setCurrentStage(control, "JkDecode");
259:                 }
260:                 decodeRequest( msg, ep, tmpMB );
261:                 if (twa != null) {
262:                     twa.setCurrentStage(control, "JkService");
263:                     twa.setParam(control,
264:                                  ((Request)ep.getRequest()).unparsedURI());
265:                 }
266:             } catch( Exception ex ) {
267:                 log.error( "Error decoding request ", ex );
268:                 msg.dump( "Incomming message");
269:                 return ERROR;
270:             }
271: 
272:             if( requiredSecret != null ) {
273:                 String epSecret=(String)ep.getNote( secretNote );
274:                 if( epSecret==null || ! requiredSecret.equals( epSecret ) )
275:                     return ERROR;
276:             }
277:             /* XXX it should be computed from request, by workerEnv */
278:             if(log.isDebugEnabled() )
279:                 log.debug("Calling next " + next.getName() + " " +

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: fix
SATE: A bug in load balancing code allows a denial of service attack through a
crafted request with invalid headers. The fix adds code to properly return a 400 error
(bad request) when this type of message is recieved.
=====================================
Possible explanation material:
=====================================
Type: fix
SATE: A bug in load balancing code allows a denial of service attack through a
crafted request with invalid headers. The fix adds code to properly return a 400 error
(bad request) when this type of message is recieved.
=====================================

			</explanation>
		</location>
		<grade
			severity="1"
			probability="1.0"
			tool_specific_rank="0.0"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.13-src/connectors/jk/java/org/apache/jk/common/HandlerRequest.java
              Path ID: 251
               Config: -cweid -nopreprep -raw -fft -mink 
      Processing time: 0d:0h:0m:0s:7ms:7ms
         Subject's ID: 20
   Subject identified: CWE-20
ResultSet: Raw ResultSet data:
[[255:63.10843808483816:ID=255, outcome=63.10843808483816], [22:13.789884494846786:ID=22, outcome=13.789884494846786], [200:37.46052386727221:ID=200, outcome=37.46052386727221], [79:24.542127386644758:ID=79, outcome=24.542127386644758], [20:0.0:ID=20, outcome=0.0], [119:9.758554850411294:ID=119, outcome=9.758554850411294], [264:7.210868113421167:ID=264, outcome=7.210868113421167], [16:52.68898660854363:ID=16, outcome=52.68898660854363]]

Sorted data:
([20:0.0:ID=20, outcome=0.0],[264:7.210868113421167:ID=264, outcome=7.210868113421167],[119:9.758554850411294:ID=119, outcome=9.758554850411294],[22:13.789884494846786:ID=22, outcome=13.789884494846786],[79:24.542127386644758:ID=79, outcome=24.542127386644758],[200:37.46052386727221:ID=200, outcome=37.46052386727221],[16:52.68898660854363:ID=16, outcome=52.68898660854363],[255:63.10843808483816:ID=255, outcome=63.10843808483816])
FileItem: strFileID: [251]
strPath: [apache-tomcat-5.5.13-src/connectors/jk/java/org/apache/jk/common/HandlerRequest.java]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[&lt;&lt;strLineNumber:270,,,
  oCVEs:[CVE-2009-0033],,,
  oCWEs:[CWE: {cweid:CWE-20, name:Input Validation}: empty: false],,,
  strExplanation:SATE: A bug in load balancing code allows a denial of service attack through a
crafted request with invalid headers. The fix adds code to properly return a 400 error
(bad request) when this type of message is recieved.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:fix,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:266,,,
  oCVEs:[CVE-2009-0033],,,
  oCWEs:[CWE: {cweid:CWE-20, name:Input Validation}: empty: false],,,
  strExplanation:SATE: A bug in load balancing code allows a denial of service attack through a
crafted request with invalid headers. The fix adds code to properly return a 400 error
(bad request) when this type of message is recieved.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:fix,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
]]]

Expected subject's ID: 20 (possible: [20])
     Expected subject: CWE-20
       Second Best ID: 264
     Second Best Name: CWE-264
            Date/time: Sat Sep 11 17:23:21 EDT 2010
Outcome o (classifier-specific): 0.0
             Distance threshold: 0.1
           Computed raw P = 1/o: Infinity
         Warning to be reported: true
          Computed normalized P: 1.0

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="3" tool_specific_id="3">
		<name cweid="119">Buffer Errors (CWE-119)</name>
		<location id="343" line="1382" path="apache-tomcat-5.5.13-src/connectors/jk/native/common/jk_ajp_common.c">
			<fragment>
1372:             }
1373:             r-&gt;start_response(r, res.status, res.msg,
1374:                               (const char *const *)res.header_names,
1375:                               (const char *const *)res.header_values,
1376:                               res.num_headers);
1377:         }
1378:         return JK_AJP13_SEND_HEADERS;
1379: 
1380:     case JK_AJP13_SEND_BODY_CHUNK:
1381:         {
1382:             unsigned int len = (unsigned int)jk_b_get_int(msg);
1383:             if (!r-&gt;write(r, msg-&gt;buf + msg-&gt;pos, len)) {
1384:                 jk_log(l, JK_LOG_INFO,
1385:                        "Connection aborted or network problems");
1386:                 JK_TRACE_EXIT(l);
1387:                 return JK_CLIENT_ERROR;
1388:             }
1389:             if (r-&gt;flush &amp;&amp; r-&gt;flush_packets)
1390:                 r-&gt;flush(r);
1391:         }
1392:         break;
1393: 
1394:     case JK_AJP13_GET_BODY_CHUNK:
1395:         {
1396:             int len = (int)jk_b_get_int(msg);
1397: 
1398:             if (len &lt; 0) {
1399:                 len = 0;
1400:             }
1401:             if (len &gt; AJP13_MAX_SEND_BODY_SZ) {
1402:                 len = AJP13_MAX_SEND_BODY_SZ;
1403:             }
1404:             if ((unsigned int)len &gt; ae-&gt;left_bytes_to_send) {
1405:                 len = ae-&gt;left_bytes_to_send;
1406:             }
1407: 

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: fix
SATE: The AJP connector uses an incorrect length for chunks, which can cause a buffer
      over-read in the ajp_process_callback in mod_jk, which allows remote attackers
      to read portions of sensitive memory.
      Fix is not useful, because it applies to ver. 5.5.17 where it was fixed, but not
      to the fixed test case, because it does not exist there.
      Patch: https://issues.apache.org/bugzilla/attachment.cgi?id=17837
=====================================

			</explanation>
		</location>
		<location id="343" line="1383" path="apache-tomcat-5.5.13-src/connectors/jk/native/common/jk_ajp_common.c">
			<fragment>
1373:             r-&gt;start_response(r, res.status, res.msg,
1374:                               (const char *const *)res.header_names,
1375:                               (const char *const *)res.header_values,
1376:                               res.num_headers);
1377:         }
1378:         return JK_AJP13_SEND_HEADERS;
1379: 
1380:     case JK_AJP13_SEND_BODY_CHUNK:
1381:         {
1382:             unsigned int len = (unsigned int)jk_b_get_int(msg);
1383:             if (!r-&gt;write(r, msg-&gt;buf + msg-&gt;pos, len)) {
1384:                 jk_log(l, JK_LOG_INFO,
1385:                        "Connection aborted or network problems");
1386:                 JK_TRACE_EXIT(l);
1387:                 return JK_CLIENT_ERROR;
1388:             }
1389:             if (r-&gt;flush &amp;&amp; r-&gt;flush_packets)
1390:                 r-&gt;flush(r);
1391:         }
1392:         break;
1393: 

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: fix
SATE: The AJP connector uses an incorrect length for chunks, which can cause a buffer
      over-read in the ajp_process_callback in mod_jk, which allows remote attackers
      to read portions of sensitive memory.
      Fix is not useful, because it applies to ver. 5.5.17 where it was fixed, but not
      to the fixed test case, because it does not exist there.
      Patch: https://issues.apache.org/bugzilla/attachment.cgi?id=17837
=====================================
Possible explanation material:
=====================================
Type: sink
SATE: The AJP connector uses an incorrect length for chunks, which can cause a buffer
      over-read in the ajp_process_callback in mod_jk, which allows remote attackers
      to read portions of sensitive memory.
      Fix is not useful, because it applies to ver. 5.5.17 where it was fixed, but not
      to the fixed test case, because it does not exist there.
      Patch: https://issues.apache.org/bugzilla/attachment.cgi?id=17837
=====================================

			</explanation>
		</location>
		<grade
			severity="1"
			probability="1.0"
			tool_specific_rank="0.0"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.13-src/connectors/jk/native/common/jk_ajp_common.c
              Path ID: 343
               Config: -cweid -nopreprep -raw -fft -mink 
      Processing time: 0d:0h:0m:0s:15ms:15ms
         Subject's ID: 119
   Subject identified: CWE-119
ResultSet: Raw ResultSet data:
[[255:53.48119574000898:ID=255, outcome=53.48119574000898], [22:10.384060155626408:ID=22, outcome=10.384060155626408], [200:27.86831937575964:ID=200, outcome=27.86831937575964], [79:17.51422048608797:ID=79, outcome=17.51422048608797], [20:9.758554850411294:ID=20, outcome=9.758554850411294], [119:0.0:ID=119, outcome=0.0], [264:10.756992110348301:ID=264, outcome=10.756992110348301], [16:43.07348896857148:ID=16, outcome=43.07348896857148]]

Sorted data:
([119:0.0:ID=119, outcome=0.0],[20:9.758554850411294:ID=20, outcome=9.758554850411294],[22:10.384060155626408:ID=22, outcome=10.384060155626408],[264:10.756992110348301:ID=264, outcome=10.756992110348301],[79:17.51422048608797:ID=79, outcome=17.51422048608797],[200:27.86831937575964:ID=200, outcome=27.86831937575964],[16:43.07348896857148:ID=16, outcome=43.07348896857148],[255:53.48119574000898:ID=255, outcome=53.48119574000898])
FileItem: strFileID: [343]
strPath: [apache-tomcat-5.5.13-src/connectors/jk/native/common/jk_ajp_common.c]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[&lt;&lt;strLineNumber:1326,,,
  oCVEs:[CVE-2008-5519],,,
  oCWEs:[CWE: {cweid:CWE-200, name:Information Leak / Disclosure}: empty: false],,,
  strExplanation:SATE: A faulty client setting content-length without providing data or a series of
rapid repeated requests could allow a user to view the response intended for another
user. See http://tomcat.apache.org/security-jk.html. Connector is not included in
Tomcat from version 5.5.28.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:path,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:1382,,,
  oCVEs:[CVE-2006-7197],,,
  oCWEs:[CWE: {cweid:CWE-119, name:Buffer Errors}: empty: false, CWE: {cweid:CWE-200, name:Information Leak / Disclosure}: empty: false],,,
  strExplanation:SATE: The AJP connector uses an incorrect length for chunks, which can cause a buffer
      over-read in the ajp_process_callback in mod_jk, which allows remote attackers
      to read portions of sensitive memory.
      Fix is not useful, because it applies to ver. 5.5.17 where it was fixed, but not
      to the fixed test case, because it does not exist there.
      Patch: https://issues.apache.org/bugzilla/attachment.cgi?id=17837,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:fix,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:1383,,,
  oCVEs:[CVE-2006-7197],,,
  oCWEs:[CWE: {cweid:CWE-119, name:Buffer Errors}: empty: false, CWE: {cweid:CWE-200, name:Information Leak / Disclosure}: empty: false],,,
  strExplanation:SATE: The AJP connector uses an incorrect length for chunks, which can cause a buffer
      over-read in the ajp_process_callback in mod_jk, which allows remote attackers
      to read portions of sensitive memory.
      Fix is not useful, because it applies to ver. 5.5.17 where it was fixed, but not
      to the fixed test case, because it does not exist there.
      Patch: https://issues.apache.org/bugzilla/attachment.cgi?id=17837,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:sink,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
]]]

Expected subject's ID: 119 (possible: [200, 119])
     Expected subject: CWE-119
       Second Best ID: 20
     Second Best Name: CWE-20
            Date/time: Sat Sep 11 17:23:22 EDT 2010
Outcome o (classifier-specific): 0.0
             Distance threshold: 0.1
           Computed raw P = 1/o: Infinity
         Warning to be reported: true
          Computed normalized P: 1.0

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="4" tool_specific_id="4">
		<name cweid="264">Permissions, Privileges, and Access Control (CWE-264) (CWE-264)</name>
		<location id="1063" line="169" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ExpandWar.java">
			<fragment>
159:                 if ((lastModified != -1) &amp;&amp; (lastModified != 0) &amp;&amp; (expandedFile != null)) {
160:                     expandedFile.setLastModified(lastModified);
161:                 }
162: 
163:                 input.close();
164:                 input = null;
165:             }
166:         } catch (IOException e) {
167:             // If something went wrong, delete expanded dir to keep things 
168:             // clean
169:             deleteDir(docBase);
170:             throw e;
171:         } finally {
172:             if (input != null) {
173:                 try {
174:                     input.close();
175:                 } catch (Throwable t) {
176:                     ;
177:                 }
178:                 input = null;
179:             }
180:             if (jarFile != null) {
181:                 try {
182:                     jarFile.close();
183:                 } catch (Throwable t) {

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: fix
SATE: Autodeploy leaves older (possibly vulnerable) files in place from a previous undeploy.
This could allow an attacker to exploit vulnerabilities that existed in an older version.
The fix improves handling of a failed undeploy by deleting leftover files.
=====================================

			</explanation>
		</location>
		<grade
			severity="1"
			probability="0.029103742369181933"
			tool_specific_rank="34.35984236374027"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ExpandWar.java
              Path ID: 1063
               Config: -cweid -nopreprep -raw -fft -mink 
      Processing time: 0d:0h:0m:0s:6ms:6ms
         Subject's ID: 264
   Subject identified: CWE-264
ResultSet: Raw ResultSet data:
[[255:98.53776513655605:ID=255, outcome=98.53776513655605], [22:48.75107520861168:ID=22, outcome=48.75107520861168], [200:72.892122233804:ID=200, outcome=72.892122233804], [79:59.710102154082044:ID=79, outcome=59.710102154082044], [20:35.434528663402595:ID=20, outcome=35.434528663402595], [119:45.06621051086559:ID=119, outcome=45.06621051086559], [264:34.35984236374027:ID=264, outcome=34.35984236374027], [16:88.1199380148313:ID=16, outcome=88.1199380148313]]

Sorted data:
([264:34.35984236374027:ID=264, outcome=34.35984236374027],[20:35.434528663402595:ID=20, outcome=35.434528663402595],[119:45.06621051086559:ID=119, outcome=45.06621051086559],[22:48.75107520861168:ID=22, outcome=48.75107520861168],[79:59.710102154082044:ID=79, outcome=59.710102154082044],[200:72.892122233804:ID=200, outcome=72.892122233804],[16:88.1199380148313:ID=16, outcome=88.1199380148313],[255:98.53776513655605:ID=255, outcome=98.53776513655605])
FileItem: strFileID: [1063]
strPath: [apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ExpandWar.java]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[&lt;&lt;strLineNumber:157,,,
  oCVEs:[CVE-2009-2902],,,
  oCWEs:[CWE: {cweid:CWE-22, name:Path Traversal}: empty: false],,,
  strExplanation:SATE: Expands the WAR without checking for directory traversal. The sink should be
somewhere in the "expand()" or "delete()" methods.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:path,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:264,,,
  oCVEs:[CVE-2009-2902],,,
  oCWEs:[CWE: {cweid:CWE-22, name:Path Traversal}: empty: false],,,
  strExplanation:SATE: Expands the WAR without checking for directory traversal. The sink should be
somewhere in the "expand()" or "delete()" methods.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:sink,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:286,,,
  oCVEs:[CVE-2009-2902],,,
  oCWEs:[CWE: {cweid:CWE-22, name:Path Traversal}: empty: false],,,
  strExplanation:SATE: Expands the WAR without checking for directory traversal. The sink should be
somewhere in the "expand()" or "delete()" methods.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:sink,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:289,,,
  oCVEs:[CVE-2009-2902],,,
  oCWEs:[CWE: {cweid:CWE-22, name:Path Traversal}: empty: false],,,
  strExplanation:SATE: Expands the WAR without checking for directory traversal. The sink should be
somewhere in the "expand()" or "delete()" methods.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:sink,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:169,,,
  oCVEs:[CVE-2009-2901],,,
  oCWEs:[CWE: {cweid:CWE-264, name:Permissions, Privileges, and Access Control}: empty: false],,,
  strExplanation:SATE: Autodeploy leaves older (possibly vulnerable) files in place from a previous undeploy.
This could allow an attacker to exploit vulnerabilities that existed in an older version.
The fix improves handling of a failed undeploy by deleting leftover files.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:fix,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:157,,,
  oCVEs:[CVE-2009-2693],,,
  oCWEs:[CWE: {cweid:CWE-22, name:Path Traversal}: empty: false],,,
  strExplanation:SATE: Checks if the filename starts with the full path it is supposed to be extracted to.
Note: the exception is not thrown in the 5.5.13 version, so there is not a real comparison
between versions.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:fix,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
]]]

Expected subject's ID: 264 (possible: [22, 264])
     Expected subject: CWE-264
       Second Best ID: 20
     Second Best Name: CWE-20
            Date/time: Sat Sep 11 17:23:27 EDT 2010
Outcome o (classifier-specific): 34.35984236374027
             Distance threshold: 0.1
           Computed raw P = 1/o: 0.029103742369181933
         Warning to be reported: true
          Computed normalized P: 0.029103742369181933

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="5" tool_specific_id="5">
		<name cweid="200">Information Leak / Disclosure (CWE-200)</name>
		<location id="1079" line="992" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java">
			<fragment>
982:         }
983:         
984:     }
985:     
986: 
987:     /**
988:      * Process a "init" event for this Context.
989:      */
990:     protected void init() {
991:         // Called from StandardContext.init()
992: 
993:         if (log.isDebugEnabled())
994:             log.debug(sm.getString("contextConfig.init"));
995:         context.setConfigured(false);
996:         ok = true;
997:         
998:         contextConfig();
999:         
1000:         try {
1001:             fixDocBase();
1002:         } catch (IOException e) {
1003:             log.error(sm.getString("contextConfig.fixDocBase"), e);
1004:         }
1005:         
1006:     }
1007:     
1008:     
1009:     /**

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: fix
SATE: A flaw in a web application to replace an XML parser used for other web applications,
allows local users to read or modify the web.xml, context.xml, or tld files of arbitrary web
applications via a crafted application that is loaded earlier than the target application.
=====================================

			</explanation>
		</location>
		<location id="1079" line="324" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java">
			<fragment>
314:             }
315:         }
316:         if (stream == null) {
317:             log.info(sm.getString("contextConfig.applicationMissing") + " " + context);
318:             return;
319:         }
320:         
321:         long t1=System.currentTimeMillis();
322: 
323:         if (webDigester == null){
324:             webDigester = createWebDigester();
325:         }
326:         
327:         URL url=null;
328:         // Process the application web.xml file
329:         synchronized (webDigester) {
330:             try {
331:                 if (altDDName != null) {
332:                     url = new File(altDDName).toURL();
333:                 } else {
334:                     url = servletContext.getResource(

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: fix
SATE: A flaw in a web application to replace an XML parser used for other web applications,
allows local users to read or modify the web.xml, context.xml, or tld files of arbitrary web
applications via a crafted application that is loaded earlier than the target application.
=====================================
Possible explanation material:
=====================================
Type: path
SATE: Note: the tests are not done in the 5.5.13 version so the line # in vulnerable test case
corresponds to a blank line in the method.
=====================================

			</explanation>
		</location>
		<location id="1079" line="630" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java">
			<fragment>
620:                 source =
621:                     new InputSource("file://" + file.getAbsolutePath());
622:                 stream = new FileInputStream(file);
623:             }
624:         } catch (Exception e) {
625:             log.error(sm.getString("contextConfig.defaultMissing") 
626:                       + " " + defaultWebXml + " " + file , e);
627:         }
628: 
629:         if (webDigester == null){
630:             webDigester = createWebDigester();
631:         }
632:         
633:         if (stream != null) {
634:             processDefaultWebConfig(webDigester, stream, source);
635:             webRuleSet.recycle();
636:         }
637: 
638:         long t2=System.currentTimeMillis();
639:         if( (t2-t1) &gt; 200 )
640:             log.debug("Processed default web.xml " + file + " "  + ( t2-t1));

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: fix
SATE: A flaw in a web application to replace an XML parser used for other web applications,
allows local users to read or modify the web.xml, context.xml, or tld files of arbitrary web
applications via a crafted application that is loaded earlier than the target application.
=====================================
Possible explanation material:
=====================================
Type: path
SATE: Note: the tests are not done in the 5.5.13 version so the line # in vulnerable test case
corresponds to a blank line in the method.
=====================================
Possible explanation material:
=====================================
Type: path
SATE: The root cause of this issue is the ContextConfig class creating the parser for web.xml whilst
it is using the webapp's classloader. This causes a problem if the app being processed includes an xml parser.
=====================================

			</explanation>
		</location>
		<location id="1079" line="792" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java">
			<fragment>
782:                 context.addWatchedResource(file.getAbsolutePath());
783:             }
784:         } catch (Exception e) {
785:             log.error(sm.getString("contextConfig.defaultMissing") 
786:                       + " " + resourceName + " " + file , e);
787:         }
788:         
789:         if (source == null)
790:             return;
791:         if (contextDigester == null){
792:             contextDigester = createContextDigester();
793:         }
794:         synchronized (contextDigester) {
795:             try {
796:                 source.setByteStream(stream);
797:                 contextDigester.setClassLoader(this.getClass().getClassLoader());
798:                 contextDigester.setUseContextClassLoader(false);
799:                 contextDigester.push(context.getParent());
800:                 contextDigester.push(context);
801:                 contextDigester.setErrorHandler(new ContextErrorHandler());
802:                 contextDigester.parse(source);

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: fix
SATE: A flaw in a web application to replace an XML parser used for other web applications,
allows local users to read or modify the web.xml, context.xml, or tld files of arbitrary web
applications via a crafted application that is loaded earlier than the target application.
=====================================
Possible explanation material:
=====================================
Type: path
SATE: Note: the tests are not done in the 5.5.13 version so the line # in vulnerable test case
corresponds to a blank line in the method.
=====================================
Possible explanation material:
=====================================
Type: path
SATE: The root cause of this issue is the ContextConfig class creating the parser for web.xml whilst
it is using the webapp's classloader. This causes a problem if the app being processed includes an xml parser.
=====================================
Possible explanation material:
=====================================
Type: path
SATE: The TldConfig's parser can be initialized with the webapp's XML parser, which causes a security problem,
since it has permission issues with reading files.
=====================================

			</explanation>
		</location>
		<grade
			severity="2"
			probability="0.18587809932714935"
			tool_specific_rank="5.379869944979258"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java
              Path ID: 1079
               Config: -cweid -nopreprep -raw -fft -mink 
      Processing time: 0d:0h:0m:0s:11ms:11ms
         Subject's ID: 200
   Subject identified: CWE-200
ResultSet: Raw ResultSet data:
[[255:29.8710556803957:ID=255, outcome=29.8710556803957], [22:20.093703511982053:ID=22, outcome=20.093703511982053], [200:5.379869944979258:ID=200, outcome=5.379869944979258], [79:10.059515249624873:ID=79, outcome=10.059515249624873], [20:33.29533225763416:ID=20, outcome=33.29533225763416], [119:23.66069928231943:ID=119, outcome=23.66069928231943], [264:34.3598423637403:ID=264, outcome=34.3598423637403], [16:19.429921089888058:ID=16, outcome=19.429921089888058]]

Sorted data:
([200:5.379869944979258:ID=200, outcome=5.379869944979258],[79:10.059515249624873:ID=79, outcome=10.059515249624873],[16:19.429921089888058:ID=16, outcome=19.429921089888058],[22:20.093703511982053:ID=22, outcome=20.093703511982053],[119:23.66069928231943:ID=119, outcome=23.66069928231943],[255:29.8710556803957:ID=255, outcome=29.8710556803957],[20:33.29533225763416:ID=20, outcome=33.29533225763416],[264:34.3598423637403:ID=264, outcome=34.3598423637403])
FileItem: strFileID: [1079]
strPath: [apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/startup/ContextConfig.java]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[&lt;&lt;strLineNumber:889,,,
  oCVEs:[CVE-2009-2902],,,
  oCWEs:[CWE: {cweid:CWE-22, name:Path Traversal}: empty: false],,,
  strExplanation:SATE: Potentially earlier in the execution path.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:path,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:899,,,
  oCVEs:[CVE-2009-2902],,,
  oCWEs:[CWE: {cweid:CWE-22, name:Path Traversal}: empty: false],,,
  strExplanation:[Unset explanation],,,
  strCodeFragment:[Unset code fragment.],,,
  strType:path,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:1252,,,
  oCVEs:[CVE-2009-2902],,,
  oCWEs:[CWE: {cweid:CWE-22, name:Path Traversal}: empty: false],,,
  strExplanation:SATE: Usually, a file named "app.war" will be first extracted in a directory called
"app/". The believe is that this location is where the application directory is removed.
Now, if the WAR file is "...war", the directory would be "../", which would have deleted
the parent directory.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:path,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:1252,,,
  oCVEs:[CVE-2009-2901],,,
  oCWEs:[CWE: {cweid:CWE-264, name:Permissions, Privileges, and Access Control}: empty: false],,,
  strExplanation:SATE: Autodeploy leaves older (possibly vulnerable) files in place from a previous undeploy.
This could allow an attacker to exploit vulnerabilities that existed in an older version.
The fix improves handling of a failed undeploy by deleting leftover files.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:path,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:992,,,
  oCVEs:[CVE-2009-0783],,,
  oCWEs:[CWE: {cweid:CWE-200, name:Information Leak / Disclosure}: empty: false],,,
  strExplanation:SATE: A flaw in a web application to replace an XML parser used for other web applications,
allows local users to read or modify the web.xml, context.xml, or tld files of arbitrary web
applications via a crafted application that is loaded earlier than the target application.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:fix,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:324,,,
  oCVEs:[CVE-2009-0783],,,
  oCWEs:[CWE: {cweid:CWE-200, name:Information Leak / Disclosure}: empty: false],,,
  strExplanation:SATE: Note: the tests are not done in the 5.5.13 version so the line # in vulnerable test case
corresponds to a blank line in the method.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:path,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:630,,,
  oCVEs:[CVE-2009-0783],,,
  oCWEs:[CWE: {cweid:CWE-200, name:Information Leak / Disclosure}: empty: false],,,
  strExplanation:SATE: The root cause of this issue is the ContextConfig class creating the parser for web.xml whilst
it is using the webapp's classloader. This causes a problem if the app being processed includes an xml parser.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:path,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:792,,,
  oCVEs:[CVE-2009-0783],,,
  oCWEs:[CWE: {cweid:CWE-200, name:Information Leak / Disclosure}: empty: false],,,
  strExplanation:SATE: The TldConfig's parser can be initialized with the webapp's XML parser, which causes a security problem,
since it has permission issues with reading files.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:path,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
]]]

Expected subject's ID: 200 (possible: [22, 200, 264])
     Expected subject: CWE-200
       Second Best ID: 79
     Second Best Name: CWE-79
            Date/time: Sat Sep 11 17:23:27 EDT 2010
Outcome o (classifier-specific): 5.379869944979258
             Distance threshold: 0.1
           Computed raw P = 1/o: 0.18587809932714935
         Warning to be reported: true
          Computed normalized P: 0.18587809932714935

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="6" tool_specific_id="6">
		<name cweid="200">Information Leak / Disclosure (CWE-200)</name>
		<location id="1105" line="4107" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/core/StandardContext.java">
			<fragment>
4097:                         ((Lifecycle) children[i]).start();
4098:                 }
4099: 
4100:                 // Start the Valves in our pipeline (including the basic),
4101:                 // if any
4102:                 if (pipeline instanceof Lifecycle) {
4103:                     ((Lifecycle) pipeline).start();
4104:                 }
4105:                 
4106:                 if(getProcessTlds()) {
4107:                     processTlds();
4108:                 }
4109:                 
4110:                 // Notify our interested LifecycleListeners
4111:                 lifecycle.fireLifecycleEvent(START_EVENT, null);
4112: 
4113:                 // Start manager
4114:                 if ((manager != null) &amp;&amp; (manager instanceof Lifecycle)) {
4115:                     ((Lifecycle) getManager()).start();
4116:                 }
4117: 

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: path
SATE: A flaw in a web application to replace an XML parser used for other web applications,
allows local users to read or modify the web.xml, context.xml, or tld files of arbitrary web
applications via a crafted application that is loaded earlier than the target application.

Note: the tests are not done in the 5.5.13 version so the line # in vulnerable test case
corresponds to a blank line in the method.

The root cause of this issue is the ContextConfig class creating the parser for web.xml whilst
it is using the webapp's classloader. This causes a problem if the app being processed includes an xml parser.

The TldConfig's parser can be initialized with the webapp's XML parser, which causes a security problem,
since it has permission issues with reading files.
=====================================

			</explanation>
		</location>
		<grade
			severity="2"
			probability="0.15282240036607656"
			tool_specific_rank="6.543543339226201"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/core/StandardContext.java
              Path ID: 1105
               Config: -cweid -nopreprep -raw -fft -mink 
      Processing time: 0d:0h:0m:0s:26ms:26ms
         Subject's ID: 200
   Subject identified: CWE-200
ResultSet: Raw ResultSet data:
[[255:19.41277271751094:ID=255, outcome=19.41277271751094], [22:30.723032984270166:ID=22, outcome=30.723032984270166], [200:6.543543339226201:ID=200, outcome=6.543543339226201], [79:19.8324589158018:ID=79, outcome=19.8324589158018], [20:43.93635963058947:ID=20, outcome=43.93635963058947], [119:34.3129096265086:ID=119, outcome=34.3129096265086], [264:45.00684815561135:ID=264, outcome=45.00684815561135], [16:8.860846656976431:ID=16, outcome=8.860846656976431]]

Sorted data:
([200:6.543543339226201:ID=200, outcome=6.543543339226201],[16:8.860846656976431:ID=16, outcome=8.860846656976431],[255:19.41277271751094:ID=255, outcome=19.41277271751094],[79:19.8324589158018:ID=79, outcome=19.8324589158018],[22:30.723032984270166:ID=22, outcome=30.723032984270166],[119:34.3129096265086:ID=119, outcome=34.3129096265086],[20:43.93635963058947:ID=20, outcome=43.93635963058947],[264:45.00684815561135:ID=264, outcome=45.00684815561135])
FileItem: strFileID: [1105]
strPath: [apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/core/StandardContext.java]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[&lt;&lt;strLineNumber:4107,,,
  oCVEs:[CVE-2009-0783],,,
  oCWEs:[CWE: {cweid:CWE-200, name:Information Leak / Disclosure}: empty: false],,,
  strExplanation:SATE: A flaw in a web application to replace an XML parser used for other web applications,
allows local users to read or modify the web.xml, context.xml, or tld files of arbitrary web
applications via a crafted application that is loaded earlier than the target application.

Note: the tests are not done in the 5.5.13 version so the line # in vulnerable test case
corresponds to a blank line in the method.

The root cause of this issue is the ContextConfig class creating the parser for web.xml whilst
it is using the webapp's classloader. This causes a problem if the app being processed includes an xml parser.

The TldConfig's parser can be initialized with the webapp's XML parser, which causes a security problem,
since it has permission issues with reading files.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:path,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
]]]

Expected subject's ID: 200 (possible: [200])
     Expected subject: CWE-200
       Second Best ID: 16
     Second Best Name: CWE-16
            Date/time: Sat Sep 11 17:23:28 EDT 2010
Outcome o (classifier-specific): 6.543543339226201
             Distance threshold: 0.1
           Computed raw P = 1/o: 0.15282240036607656
         Warning to be reported: true
          Computed normalized P: 0.15282240036607656

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="7" tool_specific_id="7">
		<name cweid="22">Path Traversal (CWE-22)</name>
		<location id="1360" line="1961" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/loader/WebappClassLoader.java">
			<fragment>
1951:                         File resourceFile = new File
1952:                             (loaderDir, jarEntry.getName());
1953:                         if (!resourceFile.exists()) {
1954:                             Enumeration entries = jarFiles[i].entries();
1955:                             while (entries.hasMoreElements()) {
1956:                                 JarEntry jarEntry2 = 
1957:                                     (JarEntry) entries.nextElement();
1958:                                 if (!(jarEntry2.isDirectory()) 
1959:                                     &amp;&amp; (!jarEntry2.getName().endsWith
1960:                                         (".class"))) {
1961:                                     resourceFile = new File
1962:                                         (loaderDir, jarEntry2.getName());
1963:                                     resourceFile.getParentFile().mkdirs();
1964:                                     FileOutputStream os = null;
1965:                                     InputStream is = null;
1966:                                     try {
1967:                                         is = jarFiles[i].getInputStream
1968:                                             (jarEntry2);
1969:                                         os = new FileOutputStream
1970:                                             (resourceFile);
1971:                                         while (true) {
1972:                                             int n = is.read(buf);
1973:                                             if (n &lt;= 0) {
1974:                                                 break;
1975:                                             }
1976:                                             os.write(buf, 0, n);

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: fix
SATE: Checks if the filename starts with the full path it is supposed to be extracted to.
Note: the exception is not thrown in the 5.5.13 version, so there is not a real comparison
between versions.
=====================================

			</explanation>
		</location>
		<grade
			severity="2"
			probability="0.10562852573374604"
			tool_specific_rank="9.467139610758778"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/loader/WebappClassLoader.java
              Path ID: 1360
               Config: -cweid -nopreprep -raw -fft -mink 
      Processing time: 0d:0h:0m:0s:14ms:14ms
         Subject's ID: 22
   Subject identified: CWE-22
ResultSet: Raw ResultSet data:
[[255:40.768982395663215:ID=255, outcome=40.768982395663215], [22:9.467139610758778:ID=22, outcome=9.467139610758778], [200:15.167549915748065:ID=200, outcome=15.167549915748065], [79:11.011207640068458:ID=79, outcome=11.011207640068458], [20:22.35739254530701:ID=20, outcome=22.35739254530701], [119:12.727345153121457:ID=119, outcome=12.727345153121457], [264:23.416621045895422:ID=264, outcome=23.416621045895422], [16:30.357307159658404:ID=16, outcome=30.357307159658404]]

Sorted data:
([22:9.467139610758778:ID=22, outcome=9.467139610758778],[79:11.011207640068458:ID=79, outcome=11.011207640068458],[119:12.727345153121457:ID=119, outcome=12.727345153121457],[200:15.167549915748065:ID=200, outcome=15.167549915748065],[20:22.35739254530701:ID=20, outcome=22.35739254530701],[264:23.416621045895422:ID=264, outcome=23.416621045895422],[16:30.357307159658404:ID=16, outcome=30.357307159658404],[255:40.768982395663215:ID=255, outcome=40.768982395663215])
FileItem: strFileID: [1360]
strPath: [apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/loader/WebappClassLoader.java]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[&lt;&lt;strLineNumber:1961,,,
  oCVEs:[CVE-2009-2693],,,
  oCWEs:[CWE: {cweid:CWE-22, name:Path Traversal}: empty: false],,,
  strExplanation:SATE: Checks if the filename starts with the full path it is supposed to be extracted to.
Note: the exception is not thrown in the 5.5.13 version, so there is not a real comparison
between versions.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:fix,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
]]]

Expected subject's ID: 22 (possible: [22])
     Expected subject: CWE-22
       Second Best ID: 79
     Second Best Name: CWE-79
            Date/time: Sat Sep 11 17:23:29 EDT 2010
Outcome o (classifier-specific): 9.467139610758778
             Distance threshold: 0.1
           Computed raw P = 1/o: 0.10562852573374604
         Warning to be reported: true
          Computed normalized P: 0.10562852573374604

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="8" tool_specific_id="8">
		<name cweid="16">Configuration (CWE-16)</name>
		<location id="1378" line="746" path="apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/authenticator/AuthenticatorBase.java">
			<fragment>
736:             Cookie cookie = new Cookie(Constants.SINGLE_SIGN_ON_COOKIE, ssoId);
737:             cookie.setMaxAge(-1);
738:             cookie.setPath("/");
739:             
740:             // Bugzilla 34724
741:             String ssoDomain = sso.getCookieDomain();
742:             if(ssoDomain != null) {
743:                 cookie.setDomain(ssoDomain);
744:             }
745: 
746:             response.addCookie(cookie);
747: 
748:             // Register this principal with our SSO valve
749:             sso.register(ssoId, principal, authType, username, password);
750:             request.setNote(Constants.REQ_SSOID_NOTE, ssoId);
751: 
752:         } else {
753:             // Update the SSO session with the latest authentication data
754:             sso.update(ssoId, principal, authType, username, password);
755:         }
756: 

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: path
SATE: The SingleSignOn Valve does not set the secure flag for the JSESSIONIDSSO cookie
in an https session, which can cause the cookie to be sent in http requests and make it
easier for remote attackers to capture this cookie.
=====================================

			</explanation>
		</location>
		<grade
			severity="3"
			probability="1.0"
			tool_specific_rank="0.0"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/authenticator/AuthenticatorBase.java
              Path ID: 1378
               Config: -cweid -nopreprep -raw -fft -mink 
      Processing time: 0d:0h:0m:0s:8ms:8ms
         Subject's ID: 16
   Subject identified: CWE-16
ResultSet: Raw ResultSet data:
[[255:13.828153488789358:ID=255, outcome=13.828153488789358], [22:39.46532220321687:ID=22, outcome=39.46532220321687], [200:15.236889756552351:ID=200, outcome=15.236889756552351], [79:28.55888257245446:ID=79, outcome=28.55888257245446], [20:52.68898660854363:ID=20, outcome=52.68898660854363], [119:43.07348896857148:ID=119, outcome=43.07348896857148], [264:53.762892714734825:ID=264, outcome=53.762892714734825], [16:0.0:ID=16, outcome=0.0]]

Sorted data:
([16:0.0:ID=16, outcome=0.0],[255:13.828153488789358:ID=255, outcome=13.828153488789358],[200:15.236889756552351:ID=200, outcome=15.236889756552351],[79:28.55888257245446:ID=79, outcome=28.55888257245446],[22:39.46532220321687:ID=22, outcome=39.46532220321687],[119:43.07348896857148:ID=119, outcome=43.07348896857148],[20:52.68898660854363:ID=20, outcome=52.68898660854363],[264:53.762892714734825:ID=264, outcome=53.762892714734825])
FileItem: strFileID: [1378]
strPath: [apache-tomcat-5.5.13-src/container/catalina/src/share/org/apache/catalina/authenticator/AuthenticatorBase.java]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[&lt;&lt;strLineNumber:746,,,
  oCVEs:[CVE-2008-0128],,,
  oCWEs:[CWE: {cweid:CWE-16, name:Configuration}: empty: false],,,
  strExplanation:SATE: The SingleSignOn Valve does not set the secure flag for the JSESSIONIDSSO cookie
in an https session, which can cause the cookie to be sent in http requests and make it
easier for remote attackers to capture this cookie.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:path,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
]]]

Expected subject's ID: 16 (possible: [16])
     Expected subject: CWE-16
       Second Best ID: 255
     Second Best Name: CWE-255
            Date/time: Sat Sep 11 17:23:30 EDT 2010
Outcome o (classifier-specific): 0.0
             Distance threshold: 0.1
           Computed raw P = 1/o: Infinity
         Warning to be reported: true
          Computed normalized P: 1.0

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
	<weakness id="9" tool_specific_id="9">
		<name cweid="79">Cross-Site Scripting (XSS) (CWE-79)</name>
		<location id="1706" line="264" path="apache-tomcat-5.5.13-src/container/webapps/host-manager/web-inf/classes/org/apache/catalina/hostmanager/HTMLHostManagerServlet.java">
			<fragment>
254:                     buf.append(aliases[0]);
255:                     for (int j = 1; j &lt; aliases.length; j++) {
256:                         buf.append(", ").append(aliases[j]);
257:                     }
258:                 }
259:                 args[1] = buf.toString();
260:                 writer.print
261:                     (MessageFormat.format(HOSTS_ROW_DETAILS_SECTION, args));
262: 
263:                 args = new Object[6];
264:                 args[0] = response.encodeURL
265:                     (request.getContextPath() +
266:                      "/html/start?name=" + hostName);
267:                 args[1] = hostsStart;
268:                 args[2] = response.encodeURL
269:                     (request.getContextPath() +
270:                      "/html/stop?name=" + hostName);
271:                 args[3] = hostsStop;
272:                 args[4] = response.encodeURL
273:                     (request.getContextPath() +
274:                      "/html/remove?name=" + hostName);
275:                 args[5] = hostsRemove;
276:                 if (host == this.host) {

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: path
SATE: The Host Manager did not escape user-provided data before including it in output.
This enables an XSS attack. The fix involves the filtration of data before use.
Note: The issue can also be mitigated by a logout or closing of the browser.
=====================================

			</explanation>
		</location>
		<location id="1706" line="268" path="apache-tomcat-5.5.13-src/container/webapps/host-manager/web-inf/classes/org/apache/catalina/hostmanager/HTMLHostManagerServlet.java">
			<fragment>
258:                 }
259:                 args[1] = buf.toString();
260:                 writer.print
261:                     (MessageFormat.format(HOSTS_ROW_DETAILS_SECTION, args));
262: 
263:                 args = new Object[6];
264:                 args[0] = response.encodeURL
265:                     (request.getContextPath() +
266:                      "/html/start?name=" + hostName);
267:                 args[1] = hostsStart;
268:                 args[2] = response.encodeURL
269:                     (request.getContextPath() +
270:                      "/html/stop?name=" + hostName);
271:                 args[3] = hostsStop;
272:                 args[4] = response.encodeURL
273:                     (request.getContextPath() +
274:                      "/html/remove?name=" + hostName);
275:                 args[5] = hostsRemove;
276:                 if (host == this.host) {
277:                     writer.print(MessageFormat.format(
278:                         MANAGER_HOST_ROW_BUTTON_SECTION, args));
279:                 } else {
280:                     writer.print(MessageFormat.format(

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: path
SATE: The Host Manager did not escape user-provided data before including it in output.
This enables an XSS attack. The fix involves the filtration of data before use.
Note: The issue can also be mitigated by a logout or closing of the browser.
=====================================
Possible explanation material:
=====================================
Type: path
SATE: The Host Manager did not escape user-provided data before including it in output.
This enables an XSS attack. The fix involves the filtration of data before use.
Note: The issue can also be mitigated by a logout or closing of the browser.
=====================================

			</explanation>
		</location>
		<location id="1706" line="272" path="apache-tomcat-5.5.13-src/container/webapps/host-manager/web-inf/classes/org/apache/catalina/hostmanager/HTMLHostManagerServlet.java">
			<fragment>
262: 
263:                 args = new Object[6];
264:                 args[0] = response.encodeURL
265:                     (request.getContextPath() +
266:                      "/html/start?name=" + hostName);
267:                 args[1] = hostsStart;
268:                 args[2] = response.encodeURL
269:                     (request.getContextPath() +
270:                      "/html/stop?name=" + hostName);
271:                 args[3] = hostsStop;
272:                 args[4] = response.encodeURL
273:                     (request.getContextPath() +
274:                      "/html/remove?name=" + hostName);
275:                 args[5] = hostsRemove;
276:                 if (host == this.host) {
277:                     writer.print(MessageFormat.format(
278:                         MANAGER_HOST_ROW_BUTTON_SECTION, args));
279:                 } else {
280:                     writer.print(MessageFormat.format(
281:                         HOSTS_ROW_BUTTON_SECTION, args));
282:                 }
283: 
284:             }

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: path
SATE: The Host Manager did not escape user-provided data before including it in output.
This enables an XSS attack. The fix involves the filtration of data before use.
Note: The issue can also be mitigated by a logout or closing of the browser.
=====================================
Possible explanation material:
=====================================
Type: path
SATE: The Host Manager did not escape user-provided data before including it in output.
This enables an XSS attack. The fix involves the filtration of data before use.
Note: The issue can also be mitigated by a logout or closing of the browser.
=====================================
Possible explanation material:
=====================================
Type: path
SATE: The Host Manager did not escape user-provided data before including it in output.
This enables an XSS attack. The fix involves the filtration of data before use.
Note: The issue can also be mitigated by a logout or closing of the browser.
=====================================

			</explanation>
		</location>
		<location id="1706" line="198" path="apache-tomcat-5.5.13-src/container/webapps/host-manager/web-inf/classes/org/apache/catalina/hostmanager/HTMLHostManagerServlet.java">
			<fragment>
188:         Object[] args = new Object[2];
189:         args[0] = request.getContextPath();
190:         args[1] = sm.getString("htmlHostManagerServlet.title");
191:         writer.print(MessageFormat.format
192:                      (Constants.BODY_HEADER_SECTION, args));
193: 
194:         // Message Section
195:         args = new Object[3];
196:         args[0] = sm.getString("htmlHostManagerServlet.messageLabel");
197:         args[1] = (message == null || message.length() == 0) ? "OK" : message;
198:         writer.print(MessageFormat.format(Constants.MESSAGE_SECTION, args));
199: 
200:         // Manager Section
201:         args = new Object[9];
202:         args[0] = sm.getString("htmlHostManagerServlet.manager");
203:         args[1] = response.encodeURL(request.getContextPath() + "/html/list");
204:         args[2] = sm.getString("htmlHostManagerServlet.list");
205:         args[3] = response.encodeURL
206:             (request.getContextPath() + "/" +
207:              sm.getString("htmlHostManagerServlet.helpHtmlManagerFile"));
208:         args[4] = sm.getString("htmlHostManagerServlet.helpHtmlManager");

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: path
SATE: The Host Manager did not escape user-provided data before including it in output.
This enables an XSS attack. The fix involves the filtration of data before use.
Note: The issue can also be mitigated by a logout or closing of the browser.
=====================================
Possible explanation material:
=====================================
Type: path
SATE: The Host Manager did not escape user-provided data before including it in output.
This enables an XSS attack. The fix involves the filtration of data before use.
Note: The issue can also be mitigated by a logout or closing of the browser.
=====================================
Possible explanation material:
=====================================
Type: path
SATE: The Host Manager did not escape user-provided data before including it in output.
This enables an XSS attack. The fix involves the filtration of data before use.
Note: The issue can also be mitigated by a logout or closing of the browser.
=====================================
Possible explanation material:
=====================================
Type: sink
SATE: The Manager and Host Manager web applications did not escape user provided
data before including it in the output. The sink is the following writer.print().
=====================================

			</explanation>
		</location>
		<location id="1706" line="260" path="apache-tomcat-5.5.13-src/container/webapps/host-manager/web-inf/classes/org/apache/catalina/hostmanager/HTMLHostManagerServlet.java">
			<fragment>
250:                 args[0] = hostName;
251:                 String[] aliases = host.findAliases();
252:                 StringBuffer buf = new StringBuffer();
253:                 if (aliases.length &gt; 0) {
254:                     buf.append(aliases[0]);
255:                     for (int j = 1; j &lt; aliases.length; j++) {
256:                         buf.append(", ").append(aliases[j]);
257:                     }
258:                 }
259:                 args[1] = buf.toString();
260:                 writer.print
261:                     (MessageFormat.format(HOSTS_ROW_DETAILS_SECTION, args));
262: 
263:                 args = new Object[6];
264:                 args[0] = response.encodeURL
265:                     (request.getContextPath() +
266:                      "/html/start?name=" + hostName);
267:                 args[1] = hostsStart;
268:                 args[2] = response.encodeURL
269:                     (request.getContextPath() +
270:                      "/html/stop?name=" + hostName);

			</fragment>
			<explanation>
Classifier for 'tool_specific_rank':
marf.Classification.Distance.MinkowskiDistance
(either minimum distance or maximum similarity)

Severity is computed from the CVE/CWE identified.
Probability is computed from the distance or similarity.

If line number is 0 we could not reconstruct it back from the waveform, yet.
If it is non-zero, it is possibly approximate.

See tool-specific output for additional details.
Possible explanation material:
=====================================
Type: path
SATE: The Host Manager did not escape user-provided data before including it in output.
This enables an XSS attack. The fix involves the filtration of data before use.
Note: The issue can also be mitigated by a logout or closing of the browser.
=====================================
Possible explanation material:
=====================================
Type: path
SATE: The Host Manager did not escape user-provided data before including it in output.
This enables an XSS attack. The fix involves the filtration of data before use.
Note: The issue can also be mitigated by a logout or closing of the browser.
=====================================
Possible explanation material:
=====================================
Type: path
SATE: The Host Manager did not escape user-provided data before including it in output.
This enables an XSS attack. The fix involves the filtration of data before use.
Note: The issue can also be mitigated by a logout or closing of the browser.
=====================================
Possible explanation material:
=====================================
Type: sink
SATE: The Manager and Host Manager web applications did not escape user provided
data before including it in the output. The sink is the following writer.print().
=====================================
Possible explanation material:
=====================================
Type: sink
SATE: The Manager and Host Manager web applications did not escape user provided
data before including it in the output. The sink is the following writer.print().
=====================================

			</explanation>
		</location>
		<grade
			severity="1"
			probability="0.1630827734318521"
			tool_specific_rank="6.131855492498557"
		/>
		<output>
			<textoutput>
			
                 File: apache-tomcat-5.5.13-src/container/webapps/host-manager/web-inf/classes/org/apache/catalina/hostmanager/HTMLHostManagerServlet.java
              Path ID: 1706
               Config: -cweid -nopreprep -raw -fft -mink 
      Processing time: 0d:0h:0m:0s:7ms:7ms
         Subject's ID: 79
   Subject identified: CWE-79
ResultSet: Raw ResultSet data:
[[255:37.31476771824022:ID=255, outcome=37.31476771824022], [22:12.604282007869042:ID=22, outcome=12.604282007869042], [200:11.796114289101942:ID=200, outcome=11.796114289101942], [79:6.131855492498557:ID=79, outcome=6.131855492498557], [20:25.964268915153884:ID=20, outcome=25.964268915153884], [119:17.547688508463246:ID=119, outcome=17.547688508463246], [264:27.155451432355164:ID=264, outcome=27.155451432355164], [16:26.908169283905156:ID=16, outcome=26.908169283905156]]

Sorted data:
([79:6.131855492498557:ID=79, outcome=6.131855492498557],[200:11.796114289101942:ID=200, outcome=11.796114289101942],[22:12.604282007869042:ID=22, outcome=12.604282007869042],[119:17.547688508463246:ID=119, outcome=17.547688508463246],[20:25.964268915153884:ID=20, outcome=25.964268915153884],[16:26.908169283905156:ID=16, outcome=26.908169283905156],[264:27.155451432355164:ID=264, outcome=27.155451432355164],[255:37.31476771824022:ID=255, outcome=37.31476771824022])
FileItem: strFileID: [1706]
strPath: [apache-tomcat-5.5.13-src/container/webapps/host-manager/web-inf/classes/org/apache/catalina/hostmanager/HTMLHostManagerServlet.java]
strFileType: [ASCII C program text]
bEmpty: [false]
oLocations: [[[&lt;&lt;strLineNumber:264,,,
  oCVEs:[CVE-2008-1947],,,
  oCWEs:[CWE: {cweid:CWE-79, name:Cross-Site Scripting (XSS)}: empty: false],,,
  strExplanation:SATE: The Host Manager did not escape user-provided data before including it in output.
This enables an XSS attack. The fix involves the filtration of data before use.
Note: The issue can also be mitigated by a logout or closing of the browser.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:path,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:268,,,
  oCVEs:[CVE-2008-1947],,,
  oCWEs:[CWE: {cweid:CWE-79, name:Cross-Site Scripting (XSS)}: empty: false],,,
  strExplanation:SATE: The Host Manager did not escape user-provided data before including it in output.
This enables an XSS attack. The fix involves the filtration of data before use.
Note: The issue can also be mitigated by a logout or closing of the browser.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:path,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:272,,,
  oCVEs:[CVE-2008-1947],,,
  oCWEs:[CWE: {cweid:CWE-79, name:Cross-Site Scripting (XSS)}: empty: false],,,
  strExplanation:SATE: The Host Manager did not escape user-provided data before including it in output.
This enables an XSS attack. The fix involves the filtration of data before use.
Note: The issue can also be mitigated by a logout or closing of the browser.,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:path,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:198,,,
  oCVEs:[CVE-2007-2450, CVE-2007-3386],,,
  oCWEs:[CWE: {cweid:CWE-79, name:Cross-Site Scripting (XSS)}: empty: false],,,
  strExplanation:SATE: The Manager and Host Manager web applications did not escape user provided
data before including it in the output. The sink is the following writer.print().,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:sink,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
, &lt;&lt;strLineNumber:260,,,
  oCVEs:[CVE-2007-2450, CVE-2007-3386],,,
  oCWEs:[CWE: {cweid:CWE-79, name:Cross-Site Scripting (XSS)}: empty: false],,,
  strExplanation:SATE: The Manager and Host Manager web applications did not escape user provided
data before including it in the output. The sink is the following writer.print().,,,
  strCodeFragment:[Unset code fragment.],,,
  strType:sink,,,
  strIgnore:false,,,
  bEmpty:false
/&gt;&gt;
]]]

Expected subject's ID: 79 (possible: [79])
     Expected subject: CWE-79
       Second Best ID: 200
     Second Best Name: CWE-200
            Date/time: Sat Sep 11 17:23:32 EDT 2010
Outcome o (classifier-specific): 6.131855492498557
             Distance threshold: 0.1
           Computed raw P = 1/o: 0.1630827734318521
         Warning to be reported: true
          Computed normalized P: 0.1630827734318521

			</textoutput>
		</output>
		<!--
			Human evaluation.
			severity:    1 ... 5
			correctness: true, quality, insignificant, unknown, false
		-->
		<!--evaluation severity="1" correctness="true">
			<comments>
			Human evaluation comments.
			</comments>
		</evaluation-->
	</weakness>
</report>
