CVE-2020-5529

Katalog CVE

CVSS 8.1 · High EPSS 4,7%

Kerentanan Improper Initialization pada htmlunit, debian linux +2 lainnya. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.

Rincian

Terbit di NVD

11 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-665: Improper Initialization
CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

4,7% peluang dieksploitasi; lebih tinggi dari 91,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/HtmlUnit/htmlunit/releases/tag/2.37.0 release notes · advisory pihak ketiga
• https://jvn.jp/en/jp/JVN34535327/ advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/08/msg00023.html mailing list · advisory pihak ketiga
• https://usn.ubuntu.com/4584-1/ advisory pihak ketiga
• https://lists.apache.org/thread.html/ra2cd7f8e61dc6b8a2d9065094cd1f46aa63ad10f237ee363e26e8563%40%3Ccommits.ca...