Code execution vulnerability in HtmlUnit
High severity
GitHub Reviewed
Published
May 21, 2020
to the GitHub Advisory Database
•
Updated Dec 7, 2023
Package
Affected versions
< 2.37.0
Patched versions
2.37.0
Description
Published by the National Vulnerability Database
Feb 11, 2020
Reviewed
May 21, 2020
Published to the GitHub Advisory Database
May 21, 2020
Last updated
Dec 7, 2023
HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.
References