Lucene search

EclipseCVE-2019-17634

HistoryJan 17, 2020 - 7:15 p.m.

CVE-2019-17634

2020-01-1719:15:11

CWE-79

eclipse

web.nvd.nist.gov

100

cve-2019-17634

eclipse memory analyzer

cross site scripting

xss

vulnerability

html report

heap dump

code execution

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

39.2%

JSON

Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report from a malicious heap dump. The user must chose todownload, open the malicious heap dump and generate an HTML report for the problem to occur. The heap dump could be specially crafted, or could come from a crafted application or from an application processing malicious data. The vulnerability is present whena report is generated and opened from the Memory Analyzer graphical user interface, or when a report generated in batch mode is then opened in Memory Analyzer or by a web browser. The vulnerability could possibly allow code execution on the local system whenthe report is opened in Memory Analyzer.

Affected configurations

Nvd

Node

eclipsememory_analyzerRange≤1.9.1

VendorProductVersionCPE
eclipsememory_analyzer*cpe:2.3:a:eclipse:memory_analyzer:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
eclipse	memory_analyzer	*	cpe:2.3:a:eclipse:memory_analyzer::::::::

CNA Affected

[
  {
    "product": "Eclipse Memory Analyzer",
    "vendor": "The Eclipse Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to version 1.9.2"
      }
    ]
  }
]

References

bugs.eclipse.org/bugs/show_bug.cgi?id=552542

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

39.2%

JSON

Related for CVE-2019-17634