CVE-2010-1423

{"id": "CVE-2010-1423", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2010-04-15T21:30:00.290", "references": [{"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2010-April/074036.html", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/63648", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/39260", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.kb.cert.org/vuls/id/886582", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.reversemode.com/index.php?option=com_content&task=view&id=67&Itemid=1", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id?1023840", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2010/0853", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57615", "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14090", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Argument injection vulnerability in the URI handler in (a) Java NPAPI plugin and (b) Java Deployment Toolkit in Java 6 Update 10, 19, and other versions, when running on Windows and possibly on Linux, allows remote attackers to execute arbitrary code via the (1) -J or (2) -XXaltjvm argument to javaws.exe, which is processed by the launch method. NOTE: some of these details are obtained from third party information."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n de argumento en el manejador URI en (a) Java NPAPI plugin y (b) Java Deployment Toolkit en Java v6 Update v10, 1v9, y otras versiones, cuando corre en Windows y probablemente en Linux, permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s del argumento (1) -J o (2) -XXaltjvm en javaws.exe, que es procesado por el m\u00e9todo launch. NOTA: algunos de estos detalles han sido obtenidos a partir de terceros."}], "lastModified": "2022-05-13T14:52:58.690", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:jdk:*:update19:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A77914E1-4F75-42AD-8220-1C53C2E74EC9", "versionEndIncluding": "1.6.0"}, {"criteria": "cpe:2.3:a:oracle:jdk:1.6.0:update10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC92B7EC-849F-4255-9D55-43681B8DADC4"}, {"criteria": "cpe:2.3:a:oracle:jre:*:update19:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35349FBC-04E5-4824-93B5-F210B902DDAC", "versionEndIncluding": "1.6.0"}, {"criteria": "cpe:2.3:a:oracle:jre:1.6.0:update_10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8160B01D-FEF3-43E6-8B37-36CF3360B6AF"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}