CVE-2008-2945
Sun Java System Access Manager 6.3 through 7.1 and Sun Java System Identity Server 6.1 and 6.2 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute arbitrary code via a…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.80%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Sun Java System Access Manager 6.3 through 7.1 and Sun Java System Identity Server 6.1 and 6.2 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute arbitrary code via a crafted stylesheet, a related issue to CVE-2007-3715, CVE-2007-3716, and CVE-2007-4289.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 2.80% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- sun/java system access manager · sun/java system identity server
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/30893
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-201538-1
- http://support.avaya.com/elmodocs2/security/ASA-2008-294.htm
- http://www.securityfocus.com/bid/29988
- http://www.securitytracker.com/id?1020380
- http://www.vupen.com/english/advisories/2008/1967/references
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43429
- http://secunia.com/advisories/30893
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-201538-1
- http://support.avaya.com/elmodocs2/security/ASA-2008-294.htm
- http://www.securityfocus.com/bid/29988
- http://www.securitytracker.com/id?1020380
- http://www.vupen.com/english/advisories/2008/1967/references
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43429
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.