CVE-2019-10182 - CVE House
Back to Database
Status published High CVE-2019-10182

It was found that icedtea-web though 1.7.2 and 1.8.2 did...

Vulnerability Description

It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-10182

Credits & Attribution

No credits recorded in the NVD database.

References

More from IcedTea

View All →
CVE-2019-10185
It was found that icedtea-web up to and including 1.7.2...
High 8.2
CVE-2019-10181
It was found that in icedtea-web up to and including...
Medium 6.3
CVE-2010-2783
IcedTea6 before 1.7.4 allow unsigned apps to read and write...
Critical 9.1
CVE-2010-2548
IcedTea6 before 1.7.4 does not properly check property access, which...
Critical 9.1

Affected Vendor

Affected Software

icedtea-web
Vulnerable Versions:
affects up to and including 1.7.2 and 1.8.2

Timeline

Official Publish: July 31st, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L

Weaknesses (CWE)

CWE-22 CWE-94

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact
T1059 Command and Scripting Interpreter
Execution
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1565.002 Stored Data Manipulation
Impact