vendor:
Java
by:
Skypher
8,8
CVSS
HIGH
Cross-site Scripting
79
CWE
Product Name: Java
Affected Version From: 6 Update 20
Affected Version To: 6 Update 20
Patch Exists: YES
Related CWE: CVE-2010-4452
CPE: cpe:a:oracle:java:6u20
Metasploit:
https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2013-0121/, https://www.rapid7.com/db/vulnerabilities/hpux-cve-2010-4452/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2011-0282/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2011-0357/, https://www.rapid7.com/db/vulnerabilities/vmsa-2011-0013-cve-2010-4452/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2010-4452/, https://www.rapid7.com/db/vulnerabilities/jre-vuln-cve-2010-4452/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2010-4452/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2011-0880/
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows XP
2010
Oracle Java Applet Children Vulnerability
This vulnerability allows an attacker to inject malicious code into a vulnerable web page. The code is executed when the page is loaded by the victim. The vulnerability is caused by the way the Oracle Java Applet handles the "children" property. An attacker can exploit this vulnerability by creating a malicious applet and embedding it in a vulnerable web page.
Mitigation:
Upgrade to the latest version of Oracle Java.
