CVE-2020-5529: apache camel Improper Initialization

Vulnerability summary

CVE-2020-5529 is a high (CVSS 8.1) Improper Initialization vulnerability in apache camel. EPSS estimates a 4.72% chance of exploitation in the next 30 days, higher than 91.7% of scored vulnerabilities.

Timeline

1. 11-02-2020
   PublishedVulnerability first disclosed.
2. 15-10-2024
   Last modifiedVulnerability information updated.

Description

HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.

• CWE-665Improper InitializationThe product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.