What is the severity of CVE-2019-17634?

CVE-2019-17634 is classified as a medium severity cross-site scripting (XSS) vulnerability.

How do I fix CVE-2019-17634?

To mitigate CVE-2019-17634, update Eclipse Memory Analyzer to version 1.9.2 or later.

What type of vulnerability is CVE-2019-17634?

CVE-2019-17634 is a cross-site scripting (XSS) vulnerability.

What could happen if I am affected by CVE-2019-17634?

If affected by CVE-2019-17634, an attacker could execute arbitrary JavaScript in the user's browser.

How does CVE-2019-17634 occur?

CVE-2019-17634 occurs when a user generates an HTML report from a malicious heap dump in Eclipse Memory Analyzer.

Vulnerability/
CVE-2019-17634

critical

CWE

17/1/2020

5/8/2024

CVE-2019-17634: XSS

First published: Fri Jan 17 2020(Updated: )

Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report from a malicious heap dump. The user must chose todownload, open the malicious heap dump and generate an HTML report for the problem to occur. The heap dump could be specially crafted, or could come from a crafted application or from an application processing malicious data. The vulnerability is present whena report is generated and opened from the Memory Analyzer graphical user interface, or when a report generated in batch mode is then opened in Memory Analyzer or by a web browser. The vulnerability could possibly allow code execution on the local system whenthe report is opened in Memory Analyzer.

Credit: emo@eclipse.org

Affected Software	Affected Version	How to fix
Eclipse Memory Analyzer	<=1.9.1

Never miss a vulnerability like this again

Reference Links

https://bugs.eclipse.org/bugs/show_bug.cgi?id=552542

Frequently Asked Questions

What is the severity of CVE-2019-17634?
CVE-2019-17634 is classified as a medium severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2019-17634?
To mitigate CVE-2019-17634, update Eclipse Memory Analyzer to version 1.9.2 or later.
What type of vulnerability is CVE-2019-17634?
CVE-2019-17634 is a cross-site scripting (XSS) vulnerability.
What could happen if I am affected by CVE-2019-17634?
If affected by CVE-2019-17634, an attacker could execute arbitrary JavaScript in the user's browser.
How does CVE-2019-17634 occur?
CVE-2019-17634 occurs when a user generates an HTML report from a malicious heap dump in Eclipse Memory Analyzer.

collector/nvd-index
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/weakness
agent/author
agent/severity
agent/last-modified-date
agent/tags
agent/references
agent/description
agent/first-publish-date
agent/event
agent/source
vendor/eclipse
canonical/eclipse memory analyzer
version/eclipse memory analyzer/1.9.1

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.