by Kastro
Paper/Archive/CVE-2023-49093

CVE-2023-49093

HtmlUnit htmlunit — HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL

EPSS 2%public exploitCVSS 9.8
critical.is priorityof 100
56
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 83.8.838 × 2016.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0

Affected

ProductAffectedFixed inSource
htmlunit< 3.9.0–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/HtmlUnit/htmlunit/security/advisories/GHSA-37vq-hr2f-g7h7refhtmlunit.org/changes-report.html#a3.9.0