DerScanner
Home / Vulnerability Database / Java : Forgery of loaded library
Java

Java : Forgery of loaded library

Classification

OWASP Top 10 2013
A1-Injection
OWASP Top 10 2017
A1-Injection
OWASP Top 10 2021
A3-InjectionA8-Software and Data Integrity Failures
OWASP MASVS
V7: 7.5.(L1/L2/L1+R/L2+R)
OWASP ASVS
Malicious Code
PCI DSS 4.0
6.2.4
CWE
CWE-114CWE-494CWE-1027
CWE/SANS Top 25 2011
CWE-494

Overview

The application loads the library from an untrusted source or in an untrusted environment. This may lead to the execution of arbitrary malicious code.

Vulnerabilities of this type occur when an attacker can change the name of the library to be loaded or parameters of the environment.

References

  1. OWASP: Process Control
  2. CWE-114: Process Control
  3. OWASP Top 10 2017-A1-Injection
  4. CWE CATEGORY: OWASP Top Ten 2017 Category A1 - Injection
MEDIUM

DerScanner Severity Score

Do you want to fix Java : Forgery of loaded library in your application?

See also

Java

Java : Race condition

Java

Java : Text4Shell Vulnerability

Java

Java : JNI usage