CVE-2019-10182: Path Traversal
It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-10182.
What is the severity of CVE-2019-10182?
The severity of CVE-2019-10182 is high.
Which software versions are affected by CVE-2019-10182?
The affected software versions for CVE-2019-10182 are icedtea-web 1.7.2 and 1.8.2.
How does CVE-2019-10182 work?
CVE-2019-10182 allows an attacker to trick a victim into running a specially crafted application and upload arbitrary files to arbitrary locations in the user's context.
Are there any references for CVE-2019-10182?
Yes, here are some references for CVE-2019-10182: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html, http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10182