CVE-2019-17634 Cross-site scripting in Eclipse Memory Analyzer

What is CVE-2019-17634?

CVE-2019-17634 is a critical cross-site scripting vulnerability in The Eclipse Foundation Eclipse Memory Analyzer, published on 17 Jan 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report from a malicious heap dump. The user must chose todownload, open the malicious heap dump and generate an HTML report for the problem to occur. The heap dump could be specially crafted, or could come from a crafted application or from an application processing malicious data. The vulnerability is present whena report is generated and opened from the Memory Analyzer graphical user interface, or when a report generated in batch mode is then opened in Memory Analyzer or by a web browser. The vulnerability could possibly allow code execution on the local system whenthe report is opened in Memory Analyzer.

Weakness: CWE-79

Which versions are affected by CVE-2019-17634?

It affects 1 product.

Products include Eclipse Memory Analyzer.

How do I fix CVE-2019-17634?

No fix has been published for CVE-2019-17634 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2019-17634 being exploited?

There is no known exploitation of CVE-2019-17634 in the wild and no public exploit code.

Other vulnerabilities in The Eclipse Foundation Eclipse Memory Analyzer

• CVE-2019-17635 Deserialization in Eclipse Memory Analyzer High 7.8
• CVE-2023-6194 XML external entity in Eclipse Memory Analyzer (tools.mat) Low 2.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-74p2-xjh7-9gv6.