CVE-2019-17634

Katalog CVE

CVSS 9.0 · Critical EPSS 1,9%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada eclipse memory analyzer. Skor CVSS 3.1 9.0 (Critical) menurut NVD.

Deskripsi (NVD)

Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report from a malicious heap dump. The user must chose todownload, open the malicious heap dump and generate an HTML report for the problem to occur. The heap dump could be specially crafted, or could come from a crafted application or from an application processing malicious data. The vulnerability is present whena report is generated and opened from the Memory Analyzer graphical user interface, or when a report generated in batch mode is then opened in Memory Analyzer or by a web browser. The vulnerability could possibly allow code execution on the local system whenthe report is opened in Memory Analyzer.

Rincian

Terbit di NVD

17 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 79,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=552542 exploit · issue tracking · advisory vendor