What is GHSA-3xrr-7m6p-p7xh?

GHSA-3xrr-7m6p-p7xh is a security advisory published by GitHub Security Advisories with Critical severity. HtmlUnit Code Injection vulnerability

Which CVE IDs does GHSA-3xrr-7m6p-p7xh cover?

GHSA-3xrr-7m6p-p7xh covers the following CVE IDs: CVE-2023-26119. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3xrr-7m6p-p7xh?

GHSA-3xrr-7m6p-p7xh has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-3xrr-7m6p-p7xh?

GHSA-3xrr-7m6p-p7xh affects 1 product, including: maven/net.sourceforge.htmlunit:htmlunit:\u003c 3.0.0.

GHSA-3xrr-7m6p-p7xhCriticalCVSS 9.8

HtmlUnit Code Injection vulnerability

Vendor

GitHub Security Advisories

Published

July 6, 2023

Last Modified

December 7, 2023

🔗 CVE IDs covered (1)

CVE-2023-26119 →

📋 Description

Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.

🎯 Affected products1

maven/net.sourceforge.htmlunit:htmlunit:< 3.0.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-26119
https://github.com/HtmlUnit/htmlunit/commit/641325bbc84702dc9800ec7037aec061ce21956b
https://security.snyk.io/vuln/SNYK-JAVA-NETSOURCEFORGEHTMLUNIT-3252500
https://siebene.github.io/2022/12/30/HtmlUnit-RCE/
https://github.com/advisories/GHSA-3xrr-7m6p-p7xh