PT-2015-3439 · Oracle+1 · Java Runtime Environment+2
Publicado
2015-09-01
·
Atualizado
2022-05-14
·
CVE-2016-4003
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Java Runtime Environment versions prior to 1.8
Java Development Kit versions prior to 1.8
Description
The issue is related to the implementation of the URLDecoder class in Java Runtime Environment and Java Development Kit, specifically when using single-byte page encoding. This allows a remote attacker to conduct cross-site scripting attacks by injecting arbitrary web script or HTML via multi-byte characters in a URL-encoded parameter.
Recommendations
For Java Runtime Environment versions prior to 1.8, update to version 1.8 or later to resolve the issue.
For Java Development Kit versions prior to 1.8, update to version 1.8 or later to resolve the issue.
As a temporary workaround, consider restricting the use of the URLDecoder function until a patch is available.
Avoid using multi-byte characters in URL-encoded parameters for the affected versions.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Struts
Java Development Kit
Java Runtime Environment