CVE-2005-3757 The Saxon XSLT parser in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to obtain sensitive information and execute arbitrary code via dangerous Java class...
HighCVSS 7.5
EPSS 41.3%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The Saxon XSLT parser in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to obtain sensitive information and execute arbitrary code via dangerous Java class methods in select attribute of xsl:value-of tags in XSLT style sheets, such as (1) system-property, (2) sys:getProperty, and (3) run:exec.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Google mini search appliance | All versions | No fix listed |
| Google search appliance | All versions | No fix listed |
References
- metasploit.com exploit patch vendor-advisory
- 17644 third-party-advisory vendor-advisory
- 1015246 exploit patch vdb-entry vendor-advisory
- 20981 exploit patch vdb-entry
- 20051121 Google Search Appliance proxystylesheet Flaws mailing-list
- 15509 exploit patch vdb-entry
- ADV-2005-2500 vdb-entry