CVE-2019-10182: icedtea-web_project icedtea-web Path Traversal
CVSS: 8.2v3.0HighModified
AliasesUBUNTU-CVE-2019-10182DEBIAN-CVE-2019-10182
Published 31-07-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-10182 is a high (CVSS 8.2) Path Traversal vulnerability in icedtea-web_project icedtea-web. EPSS estimates a 2.74% chance of exploitation in the next 30 days, higher than 86% of scored vulnerabilities.
CVSS score
8.2/10
010
High · v3.0 (CVE.org)EPSS score
2.74%
0%100%
Low · -0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 8 · Related 4Timeline
- 31-07-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user.
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 8.2Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:LSources4 sources · 6.5–8.2
- NVDNIST6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NDiffers
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NDiffers
Medium 5.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:P/A:PSourcesSingle source
EPSS trend
Probability
2.74%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
-0.04 pp
From 2.78% on 21-09-2026
21-09-202621-10-2026
EPSS score2.74%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Affected systems
Redhat5 products
Debian1 product
- icedtea-web< 1.8.3-1
Icedtea1 product
- icedtea-webaffects up to and including 1.7.2 and 1.8.2
Icedtea-web_project1 product
- icedtea-web≤ 1.7.2 | 1.8.2
Ubuntu1 product
- icedtea-webAll versions (No fix recorded)
5 vendors · 9 products
References
11 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10182X Refsource CONFIRMIssue TrackingThird Party AdvisoryREPORT
- packetstormsecurity.com/files/…X Refsource MISC