Description
HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
HtmlUnit Project HtmlUnit
prior to 2.37.0affected
References
- https://github.com/HtmlUnit/htmlunit/releases/tag/2.37.0 ↗
- https://jvn.jp/en/jp/JVN34535327/ ↗
- https://lists.apache.org/thread.html/ra2cd7f8e61dc6b8a2d9065094cd1f46aa63ad10f237ee363e26e8563%40%3Ccommits.camel.apache.org%3E ↗
- https://lists.debian.org/debian-lts-announce/2020/08/msg00023.html ↗
- https://usn.ubuntu.com/4584-1/ ↗