// For flags

CVE-2019-17634

 

Severity Score

9.0
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report from a malicious heap dump. The user must chose todownload, open the malicious heap dump and generate an HTML report for the problem to occur. The heap dump could be specially crafted, or could come from a crafted application or from an application processing malicious data. The vulnerability is present whena report is generated and opened from the Memory Analyzer graphical user interface, or when a report generated in batch mode is then opened in Memory Analyzer or by a web browser. The vulnerability could possibly allow code execution on the local system whenthe report is opened in Memory Analyzer.

Eclipse Memory Analyzer versión 1.9.1 y versiones anteriores está sujeto a una vulnerabilidad de cross site scripting (XSS) al generar un informe HTML a partir de un volcado de almacenamiento dinámico malintencionado. El usuario debe elegir descargar, abrir el volcado de almacenamiento dinámico malintencionado y generar un informe HTML para que se produzca el problema. El volcado de montón podría ser especialmente diseñado, o podría provenir de una aplicación diseñada o de una aplicación que procesa datos malintencionados. La vulnerabilidad está presente cuando se genera y abre un informe desde la interfaz gráfica de usuario del Analizador de memoria, o cuando se abre un informe generado en modo por lotes en el Analizador de memoria o por un explorador web. La vulnerabilidad podría permitir la ejecución de código en el sistema local cuando se abre el informe en el Analizador de memoria.

*Credits: Thanks to Iassen Minov for reporting the issue.
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-10-16 CVE Reserved
  • 2020-01-17 CVE Published
  • 2023-05-22 EPSS Updated
  • 2024-08-05 CVE Updated
  • 2024-08-05 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (1)
URL Tag Source
URL Date SRC
https://bugs.eclipse.org/bugs/show_bug.cgi?id=552542 2024-08-05
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Eclipse
Search vendor "Eclipse"
 Memory Analyzer
Search vendor "Eclipse" for product "Memory Analyzer"
 <= 1.9.1
Search vendor "Eclipse" for product "Memory Analyzer" and version " <= 1.9.1"
-
Affected