by Kastro
Paper/Archive/CVE-2023-26119

CVE-2023-26119

snyk — Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL,…

EPSS 3%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 84.7.847 × 2016.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.

Affected

ProductAffectedFixed inSource
net.sourceforge.htmlunit:htmlunit< 3.0.03.0.0CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsecurity.snyk.io/vuln/SNYK-JAVA-NETSOURCEFORGEHTMLUNIT-3252500refgithub.com/HtmlUnit/htmlunit/commit/641325bbc84702dc9800ec7037aec061ce21956brefsiebene.github.io/2022/12/30/HtmlUnit-RCE