Input validation error in HtmlUnit - CVE-2022-28366

Vulnerability identifier: #VU77777

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-28366

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of crafted Processing Instruction (PI) input. A remote attacker can trick the victim to visit a specially crafted web page and perform a denial of service (DoS) attack.

HtmlUnit
Log Analysis
Jira Service Management Data Center
Jira Service Management Server
Confluence Data Center
Jira Software Data Center
Bamboo Server
Bitbucket Data Center
IBM Security Verify Governance
Crowd Server
Confluence Server
Jira Software Server
Bitbucket Server

Install updates from vendor's website.

HtmlUnit - update to 2.27
Log Analysis - update to 1.3.8.1
Jira Service Management Data Center - addressed in versions 4.20.28, 5.4.12
Jira Service Management Server - addressed in versions 4.20.28, 5.4.12
Crowd Server - addressed in versions 5.0.8, 5.1.6, 5.2.1
Confluence Data Center - addressed in versions 7.19.17, 8.3.4, 8.4.5, 8.5.4, 8.6.1, 8.6.2, 8.7.1
Confluence Server - addressed in versions 7.19.17, 8.3.4, 8.4.5, 8.5.4, 8.6.1, 8.6.2
Jira Software Server - addressed in versions 9.4.18, 9.12.5, 9.14.0
Jira Software Data Center - addressed in versions 9.4.18, 9.12.5, 9.14.0
Bamboo Server - addressed in versions 9.2.7, 9.3.5
Bitbucket Data Center - addressed in versions 7.21.18, 8.9.7, 8.11.6, 8.12.4, 8.13.3, 8.14.2
Bitbucket Server - addressed in versions 7.21.18, 8.9.7, 8.11.6, 8.12.4, 8.13.3, 8.14.2
IBM Security Verify Governance - update to 10.0.2.0.2

• https://github.com/nahsra/antisamy/releases/tag/v1.6.6
• https://sourceforge.net/projects/htmlunit/files/htmlunit/2.27/
• https://search.maven.org/artifact/net.sourceforge.htmlunit/neko-htmlunit

• Denial of service in HtmlUnit
• Two vulnerabilities in Confluence Data Center and Server
• Atlassian Bamboo Data Center and Server update for third-party applications
• Atlassian Jira Service Management Data Center and Server update for third-party software
• Atlassian Crowd Data Center and Server update for third-party software
• Atlassian Confluence Data Center and Server update for third-party software
• Atlassian Bitbucket Data Center and Server update for third-party software
• Jira Software Data Center and Server update for nekohtml
• Multiple vulnerabilities in IBM Security Verify Governance - Identity Manager
• Multiple vulnerabilities in IBM Log Analysis