PT-2015-3451 · Jsoup+1 · Jsoup+1

Hardy Ferentschik · Published 2015-07-06 · Updated 2024-08-16 · CVE-2015-6748

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions jsoup versions prior to 1.8.3

Description The issue is related to a lack of protection for the structure of web pages, which can be exploited to perform cross-site scripting (XSS) attacks. This allows a remote attacker to carry out XSS attacks.

Recommendations For versions prior to 1.8.3, update to version 1.8.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the jsoup library until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2016-2366

BDU:2024-01744

CVE-2015-6748

DLA-2075-1

GHSA-48RH-QGJR-XFJ6

MGASA-2015-0340

Affected Products

Alt Linux

Jsoup

References · 30

• https://github.com/jhy/jsoup/pull/582 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-6748 · Security Note
• https://advisories.mageia.org/MGASA-2015-0340.html · Security Note
• https://security-tracker.debian.org/tracker/DLA-2075-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-6748 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-6748 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-48rh-qgjr-xfj6 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01744 · Security Note
• https://osv.dev/vulnerability/DLA-2075-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2016-2366 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6748 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-6748 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-6748 · Security Note
• https://security-tracker.debian.org/tracker/source-package/jsoup · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-6748 · Vendor Advisory