CVE-2023-2798 Denial of service in HtmlUnit

2023-05-2513:54:52

CWE-400

Google

www.cve.org

htmlunit

cve-2023-2798

dos

denial of service

vulnerability

browsing

untrusted web pages

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

38.1%

JSON

Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an attacker may supply content that causes HtmlUnit to crash by a stack overflow. This effect may support a denial of service attack.This issue affects htmlunit before 2.70.0.

CNA Affected

[
  {
    "collectionURL": "https://github.com/HtmlUnit/",
    "defaultStatus": "unaffected",
    "packageName": "htmlunit",
    "repo": "https://github.com/HtmlUnit/htmlunit",
    "versions": [
      {
        "lessThan": "2.70.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]