CVEvulnerability
CVE-2005-3757
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2005-11-22
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
The Saxon XSLT parser in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to obtain sensitive information and execute arbitrary code via dangerous Java class methods in select attribute of xsl:value-of tags in XSLT style sheets, such as (1) system-property, (2) sys:getProperty, and (3) run:exec.
Affected configurations
• google mini search appliance
• google search appliance
References
- http://metasploit.com/research/vulns/google_proxystylesheet/ Exploit, Patch, Vendor Advisory
- http://secunia.com/advisories/17644 Vendor Advisory
- http://securitytracker.com/id?1015246 Exploit, Patch, Vendor Advisory
- http://www.osvdb.org/20981 Exploit, Patch
- http://www.securityfocus.com/archive/1/417310/30/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/15509 Exploit, Patch
- http://www.vupen.com/english/advisories/2005/2500 www.vupen.com
- http://metasploit.com/research/vulns/google_proxystylesheet/ Exploit, Patch, Vendor Advisory
- http://secunia.com/advisories/17644 Vendor Advisory
- http://securitytracker.com/id?1015246 Exploit, Patch, Vendor Advisory
- http://www.osvdb.org/20981 Exploit, Patch
- http://www.securityfocus.com/archive/1/417310/30/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/15509 Exploit, Patch
- http://www.vupen.com/english/advisories/2005/2500 www.vupen.com