GHSA-5mh9-r3rr-9597

Suggest an improvement
Source
https://github.com/advisories/GHSA-5mh9-r3rr-9597
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/05/GHSA-5mh9-r3rr-9597/GHSA-5mh9-r3rr-9597.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5mh9-r3rr-9597
Aliases
Downstream
CGA (6)
Published
2020-05-21T21:08:33Z
Modified
2024-10-15T23:41:37Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Code execution vulnerability in HtmlUnit
Details

HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.

Database specific 
{
    "cwe_ids":  [
        "CWE-665",
        "CWE-94"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-05-21T17:25:38Z",
    "nvd_published_at":  "2020-02-11T12:15:00Z",
    "severity":  "HIGH"
}
References

Affected packages

Maven / net.sourceforge.htmlunit:htmlunit

Package

Name
net.sourceforge.htmlunit:htmlunit
View open source insights on deps.dev
Purl
pkg:maven/net.sourceforge.htmlunit/htmlunit

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.37.0

Affected versions

1.*
1.14
2.*
2.0
2.1
2.1.5
2.2
2.3
2.4
2.5
2.6
2.7
2.8
2.9
2.10
2.11
2.12
2.13
2.14
2.15
2.16
2.17
2.18
2.19
2.20
2.21
2.22
2.23
2.24
2.25
2.26
2.27
2.28
2.29
2.30
2.31
2.32
2.33
2.34.0
2.34.1
2.35.0
2.36.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/05/GHSA-5mh9-r3rr-9597/GHSA-5mh9-r3rr-9597.json"