CVE-2013-5772: Low severity oracle jre vulnerability
It was discovered that jhat (Java Heap Analysis Tool) failed to properly escape all data embedded into HTML pages it generates. A specially crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct a Cross-Site Scripting attacks against users view jhat generated pages.
Other sources
Unspecified vulnerability in the Java SE component in Oracle Java SE Java SE 7u40 and earlier and Java SE 6u60 and earlier allows remote attackers to affect integrity via unknown vectors related to jhat.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-5772?
CVE-2013-5772 is considered a moderate severity vulnerability due to its potential for Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2013-5772?
To fix CVE-2013-5772, update to the versions 2.4.3 of IcedTea or 1.11.14 and 1.12.7 of IcedTea, as well as ensuring all Java environments are updated to the latest versions.
What software is affected by CVE-2013-5772?
CVE-2013-5772 affects various versions of Oracle JDK and JRE, along with IcedTea packages prior to the specified remedied versions.
What kind of attacks can CVE-2013-5772 facilitate?
CVE-2013-5772 can facilitate Cross-Site Scripting (XSS) attacks by allowing an attacker to inject malicious scripts into web pages viewed by users.
What are the best practices to mitigate risks for CVE-2013-5772?
Best practices include regularly updating software to the latest versions, implementing input validation, and using Content Security Policy (CSP) to limit script execution.