En bref
- CVE-2022-28366 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant net.sourceforge.htmlunit:neko-htmlunit, antisamy (antisamy project), cyberneko html (cyberneko html project).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.2%, plus élevée que 82.4% des vulnérabilités.
- Correctif : mettre à jour vers 2.27, 1.6.6 ou plus récent.
Description
Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24939.
NVD description
Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24839.
Autres vulnérabilités de net.sourceforge.htmlunit:neko-htmlunit
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free