{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4f1c2a9e-7b3d-4e58-9a6c-2d8e5f0b1a37",
  "version": 1,
  "metadata": {
    "timestamp": "2024-06-01T10:00:00Z",
    "tools": {
      "components": [
        {
          "type": "application",
          "group": "org.cyclonedx",
          "name": "cyclonedx-maven-plugin",
          "version": "2.7.9"
        }
      ]
    },
    "component": {
      "type": "application",
      "bom-ref": "apache-tooling-community-over-code",
      "group": "org.apache.demo",
      "name": "apache-tooling-community-over-code",
      "version": "0.9.0",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "supplier": {
        "name": "The Apache Software Foundation",
        "url": [
          "https://apache.org/"
        ]
      },
      "purl": "pkg:maven/org.apache.demo/apache-tooling-community-over-code@1.0.0"
    },
    "supplier": {
      "name": "The Apache Software Foundation",
      "url": [
        "https://apache.org/"
      ]
    }
  },
  "components": [
    {
      "type": "library",
      "bom-ref": "commons-lang3",
      "group": "org.apache.commons",
      "name": "commons-lang3",
      "version": "3.14.0",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "supplier": {
        "name": "The Apache Software Foundation",
        "url": [
          "https://apache.org/"
        ]
      },
      "purl": "pkg:maven/org.apache.commons/commons-lang3@3.14.0"
    },
    {
      "type": "library",
      "bom-ref": "slf4j-api",
      "group": "org.slf4j",
      "name": "slf4j-api",
      "version": "2.0.13",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "supplier": {
        "name": "QOS.ch"
      },
      "purl": "pkg:maven/org.slf4j/slf4j-api@2.0.13"
    },
    {
      "type": "framework",
      "bom-ref": "spring-core",
      "group": "org.springframework",
      "name": "spring-core",
      "version": "5.3.30",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "supplier": {
        "name": "Broadcom"
      },
      "purl": "pkg:maven/org.springframework/spring-core@5.3.30"
    },
    {
      "type": "library",
      "bom-ref": "log4j-core",
      "group": "org.apache.logging.log4j",
      "name": "log4j-core",
      "version": "2.14.1",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "supplier": {
        "name": "The Apache Software Foundation",
        "url": [
          "https://apache.org/"
        ]
      },
      "purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1"
    },
    {
      "type": "library",
      "bom-ref": "jackson-databind",
      "group": "com.fasterxml.jackson.core",
      "name": "jackson-databind",
      "version": "2.9.10",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "supplier": {
        "name": "FasterXML"
      },
      "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10"
    },
    {
      "type": "library",
      "bom-ref": "jetty-server",
      "group": "org.eclipse.jetty",
      "name": "jetty-server",
      "version": "9.4.43.v20210629",
      "licenses": [
        {
          "expression": "EPL-2.0 OR Apache-2.0"
        }
      ],
      "supplier": {
        "name": "Eclipse Foundation"
      },
      "purl": "pkg:maven/org.eclipse.jetty/jetty-server@9.4.43.v20210629"
    },
    {
      "type": "library",
      "bom-ref": "jakarta.annotation-api",
      "group": "jakarta.annotation",
      "name": "jakarta.annotation-api",
      "version": "2.1.1",
      "licenses": [
        {
          "expression": "EPL-2.0 OR GPL-2.0-with-classpath-exception"
        }
      ],
      "supplier": {
        "name": "Eclipse Foundation"
      },
      "purl": "pkg:maven/jakarta.annotation/jakarta.annotation-api@2.1.1"
    },
    {
      "type": "library",
      "bom-ref": "rhino",
      "group": "org.mozilla",
      "name": "rhino",
      "version": "1.7.14",
      "licenses": [
        {
          "license": {
            "id": "MPL-2.0"
          }
        }
      ],
      "purl": "pkg:maven/org.mozilla/rhino@1.7.14"
    },
    {
      "type": "library",
      "bom-ref": "mysql-connector",
      "group": "mysql",
      "name": "mysql-connector-java",
      "version": "8.0.33",
      "licenses": [
        {
          "license": {
            "id": "GPL-2.0-only"
          }
        }
      ],
      "supplier": {
        "name": "Oracle"
      },
      "purl": "pkg:maven/mysql/mysql-connector-java@8.0.33"
    },
    {
      "type": "library",
      "bom-ref": "acme-utils",
      "group": "com.example",
      "name": "acme-utils",
      "version": "3.2",
      "licenses": [
        {
          "license": {
            "name": "Acme Corp Proprietary Licence"
          }
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "apache-tooling-community-over-code",
      "dependsOn": [
        "commons-lang3",
        "log4j-core",
        "jackson-databind",
        "jetty-server"
      ]
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "vuln:log4j-core/GHSA-jfh8-c2jp-5v3q",
      "id": "GHSA-jfh8-c2jp-5v3q",
      "source": {
        "name": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-jfh8-c2jp-5v3q"
      },
      "description": "Remote code injection in Log4j (Log4Shell, CVE-2021-44228)",
      "detail": "Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints. Upgrade to 2.17.1 or later.",
      "cwes": [
        502,
        400,
        20
      ],
      "published": "2021-12-10T00:40:56Z",
      "updated": "2024-06-01T00:00:00Z",
      "affects": [
        {
          "ref": "log4j-core"
        }
      ],
      "ratings": [
        {
          "severity": "critical",
          "method": "CVSSv31",
          "score": 10.0,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
        }
      ]
    },
    {
      "bom-ref": "vuln:jackson-databind/GHSA-57j2-w4cx-62h2",
      "id": "GHSA-57j2-w4cx-62h2",
      "source": {
        "name": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-57j2-w4cx-62h2"
      },
      "description": "Deeply nested json in jackson-databind (CVE-2020-36518)",
      "cwes": [
        787
      ],
      "published": "2022-03-12T00:00:36Z",
      "updated": "2024-06-01T00:00:00Z",
      "affects": [
        {
          "ref": "jackson-databind"
        }
      ],
      "ratings": [
        {
          "severity": "high",
          "method": "CVSSv31",
          "score": 7.5,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ]
    }
  ]
}

.