CVE-2019-17634: XSS
Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report from a malicious heap dump. The user must chose todownload, open the malicious heap dump and generate an HTML report for the problem to occur. The heap dump could be specially crafted, or could come from a crafted application or from an application processing malicious data. The vulnerability is present whena report is generated and opened from the Memory Analyzer graphical user interface, or when a report generated in batch mode is then opened in Memory Analyzer or by a web browser. The vulnerability could possibly allow code execution on the local system whenthe report is opened in Memory Analyzer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-17634?
CVE-2019-17634 is classified as a medium severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2019-17634?
To mitigate CVE-2019-17634, update Eclipse Memory Analyzer to version 1.9.2 or later.
What type of vulnerability is CVE-2019-17634?
CVE-2019-17634 is a cross-site scripting (XSS) vulnerability.
What could happen if I am affected by CVE-2019-17634?
If affected by CVE-2019-17634, an attacker could execute arbitrary JavaScript in the user's browser.
How does CVE-2019-17634 occur?
CVE-2019-17634 occurs when a user generates an HTML report from a malicious heap dump in Eclipse Memory Analyzer.