Sensitive Information Exposure in Google Mini Search Appliance

CVE-2005-3757

Summary

The Saxon XSLT parser in the Google Mini Search Appliance, along with the Google Search Appliance, contains a vulnerability that allows remote attackers to exploit specific dangerous Java class methods in certain attributes of xsl:value-of tags within XSLT stylesheets. This exposure may lead to unauthorized access to sensitive information and the potential execution of arbitrary code, utilizing methods such as system-property, sys:getProperty, and run:exec. The flaw poses a significant risk, as it allows for targeted manipulation by attackers, putting users at risk of data breaches.

References