Send/Cancel Meeting Request and Generate iCalendar

Does it work with all versions of office / outlook?

• Fixed backwards compatibility

• Security fixes

We used "Blackduck" tool for vulnerability test of the plugin.  Tom Ryan

The vulnerability issues we have are mentioned below. Please check and let me know what can be done on this Tom Ryan

1) SendCancelMeetingRequestandGenerateiCalendar-4.3.5 (maven)
Issue: Multiple PHP remote file inclusion vulnerabilities in 2le.net Castor PHP Web Builder 1.1.1 allow remote attackers to execute arbitrary PHP code via the rootpath parameter in (1) lib/code.php, (2) lib/dbconnect.php, (3) lib/error.php, (4) lib/menu.php, and other unspecified files.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.


2) SendCancelMeetingRequestandGenerateiCalendar-4.3.5 (maven)
Issue: The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.

Tom Ryan waiting on your reply. 

I was not able to reproduce this issue with a simple test. Can you share the configurations you are using for the smart service? Do you have any custom configurations for sending mail from your Appian Cloud site?

This plugin should use the version of Log4J provided by the Appian environment where it is deployed. If you have not already, make sure to upgrade / apply the latest Appian hotfix to ensure any Log4J issues are patched.

Are there any log4j vulnerability issues with this plug in going on? When a vulnerability scan has been done, this plug in did not pass the test. Tom Ryan

Hi Tom,

we are using Appian Cloud 21.3 and after updating plugin to v4.3.5 send iCalendar via email stopped working.

This is an error log example:

2022-01-21 17:49:52,251 [Appian Work Item - 4740 - execution01 : UnattendedJavaActivityRequest] ERROR com.appiancorp.ical.Mail - Could not send mail via eu-west-3.smtp-gateway.appian-customer.com:587 to 
com.sun.mail.smtp.SMTPSendFailedException: 530 5.7.0 Must issue a STARTTLS command first

	at com.sun.mail.smtp.SMTPTransport.issueSendCommand(SMTPTransport.java:2108)
	at com.sun.mail.smtp.SMTPTransport.mailFrom(SMTPTransport.java:1609)
	at com.sun.mail.smtp.SMTPTransport.sendMessage(SMTPTransport.java:1117)
	at com.appiancorp.ical.Mail.sendMessage(Mail.java:124)
	at com.appiancorp.ical.SendMeetingRequestActivity_v4.run(SendMeetingRequestActivity_v4.java:117)
	at com.appiancorp.process.runtime.framework.DefaultActivityExecutor$1.lambda$call$0(DefaultActivityExecutor.java:131)
	at com.appiancorp.plugins.PluginUsageLogger.runWithPluginInformation(PluginUsageLogger.java:52)
	at com.appiancorp.process.runtime.framework.DefaultActivityExecutor$1.call(DefaultActivityExecutor.java:131)
	at com.appiancorp.process.runtime.framework.DefaultActivityExecutor$1.call(DefaultActivityExecutor.java:125)
	at com.appiancorp.common.ContextClassLoaderSwitcher.runInContext(ContextClassLoaderSwitcher.java:27)
	at com.appiancorp.process.runtime.framework.DefaultActivityExecutor.execute(DefaultActivityExecutor.java:125)
	at com.appiancorp.process.engine.UnattendedJavaActivityRequest.execute(UnattendedJavaActivityRequest.java:88)
	at com.appiancorp.process.engine.UnattendedJavaActivityRequestResponseCreator.getJavaActivityResultResponse(UnattendedJavaActivityRequestResponseCreator.java:21)
	at com.appiancorp.process.engine.UnattendedJavaActivityRequest.getJavaActivityResultResponse(UnattendedJavaActivityRequest.java:67)
	at com.appiancorp.process.engine.UnattendedJavaActivityRequest.execute0(UnattendedJavaActivityRequest.java:55)
	at com.appiancorp.common.persistence.data.AppianDataUserContextProvider.executeWithConsistentDataReads(AppianDataUserContextProvider.java:116)
	at com.appiancorp.process.engine.ProcessContinuationRequest.executeOuter(ProcessContinuationRequest.java:68)
	at com.appiancorp.process.engine.ContinuationRequest.execute(ContinuationRequest.java:123)
	at com.appiancorp.process.workpoller.UnattendedRequestHandlerBean.onMessage(UnattendedRequestHandlerBean.java:36)
	at com.appiancorp.process.workpoller.WorkItem.run(WorkItem.java:94)
	at org.springframework.jca.work.SimpleTaskWorkManager$DelegatingWorkAdapter.run(SimpleTaskWorkManager.java:239)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
	at java.lang.Thread.run(Thread.java:748)

Can you help me?

KR.

Simone.