PT-2023-6900 · Unknown · Net.Sourceforge.Htmlunit:Htmlunit

Siebene · Publicado 2023-04-03 · Atualizado 2026-05-25 · CVE-2023-26119

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions net.sourceforge.htmlunit:htmlunit versions 0 through 3.0.0

Description The issue is related to incorrect code generation management in the HtmlUnit browser, which can be exploited to execute arbitrary code remotely via XSTL when browsing an attacker's webpage. This can allow a remote attacker to execute arbitrary code.

Recommendations For versions 0 through 3.0.0, update to a version later than 3.0.0 to resolve the issue. As a temporary workaround, consider restricting access to web pages that may exploit this vulnerability until a patch is available.

Exploit

Correção

Special Elements Injection

Code Injection

Enumeração de Fraquezas

CWE-74

CWE-94

Identificadores relacionados

BDU:2023-07918

CVE-2023-26119

GHSA-3XRR-7M6P-P7XH

Produtos afetados

Net.Sourceforge.Htmlunit:Htmlunit

Referências · 13

• 🔥 https://siebene.github.io/2022/12/30/HtmlUnit-RCE · Exploit
• https://github.com/HtmlUnit/htmlunit · Nota
• https://github.com/HtmlUnit/htmlunit/commit/641325bbc84702dc9800ec7037aec061ce21956b · Correção
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2023-26119 · Aviso do Fabricante
• https://security.snyk.io/vuln/SNYK-JAVA-NETSOURCEFORGEHTMLUNIT-3252500 · Nota
• https://bdu.fstec.ru/vul/2023-07918 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-26119 · Nota de Segurança
• https://t.me/cvenotify/47417 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-3xrr-7m6p-p7xh · Aviso do Fabricante
• https://t.me/cibsecurity/61315 · Publicação no Telegram
• https://t.me/cvenotify/62761 · Publicação no Telegram
• https://t.me/cvenotify/47406 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-26119 · Aviso do Fabricante