PT-2019-3692 · Oracle+5 · Java Se+6
Published
2019-10-15
·
Updated
2024-06-15
·
CVE-2019-2999
CVSS v3.1
4.7
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Java SE versions 7u231, 8u221, 11.0.4, and 13
Description
The issue allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE, requiring human interaction from a person other than the attacker. Successful attacks can result in unauthorized update, insert, or delete access to some of Java SE accessible data, as well as unauthorized read access to a subset of Java SE accessible data. This vulnerability applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets.
Recommendations
For Java SE version 7u231, update to a version that includes the fix for this issue.
For Java SE version 8u221, update to a version that includes the fix for this issue.
For Java SE version 11.0.4, update to a version that includes the fix for this issue.
For Java SE version 13, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the Javadoc component until a patch is available.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Centos
Ibm Aix
Java Platform
Java Se
Red Hat
Suse
Ubuntu