9.3

CVE-2007-3715

Sun Java System Application Server and Web Server 7.0 through 9.0 before 20070710 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute an arbitrary Java method via a crafted stylesheet, a related issue to CVE-2007-3716.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sun ≫ Java System Application Server Version 8.2 Edition enterprise
Sun ≫ Java System Application Server Version 8.2 Edition enterprise_linux
Sun ≫ Java System Application Server Version 8.2 Edition enterprise_sparc
Sun ≫ Java System Application Server Version 8.2 Edition enterprise_windows
Sun ≫ Java System Application Server Version 8.2 Edition enterprise_x86
Sun ≫ Java System Application Server Version 8.2 Edition platform
Sun ≫ Java System Application Server Version 8.2 Edition platform_linux
Sun ≫ Java System Application Server Version 8.2 Edition platform_sparc
Sun ≫ Java System Application Server Version 8.2 Edition platform_windows
Sun ≫ Java System Application Server Version 8.2 Edition platform_x86
Sun ≫ Java System Application Server Version 9.0 Edition platform
Sun ≫ Java System Application Server Version 9.0 Edition platform_linux
Sun ≫ Java System Application Server Version 9.0 Edition platform_sparc
Sun ≫ Java System Application Server Version 9.0 Edition platform_windows
Sun ≫ Java System Application Server Version 9.0 Edition platform_x86
Sun ≫ Java System Web Server Version 7.0
Sun ≫ Java System Web Server Version 7.0 Edition hp_ux
Sun ≫ Java System Web Server Version 7.0 Edition linux
Sun ≫ Java System Web Server Version 7.0 Edition sparc
Sun ≫ Java System Web Server Version 7.0 Edition windows
Sun ≫ Java System Web Server Version 7.0 Edition x86
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.28% 0.812
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://osvdb.org/37248
http://secunia.com/advisories/26023
Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102992-1
Patch
Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200054-1
Vendor Advisory
http://www.isecpartners.com/advisories/2007-04-dsig.txt
http://www.isecpartners.com/files/XMLDSIG_Command_Injection.pdf
http://www.securityfocus.com/archive/1/473552/100/0/threaded
http://www.securityfocus.com/archive/1/473553/100/0/threaded
http://www.securityfocus.com/bid/24850
Patch
http://www.vupen.com/english/advisories/2007/2493
Vendor Advisory
http://www.vupen.com/english/advisories/2007/2785
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/35335