VulnerabilityModified
CVE-2009-2445
Oracle iPlanet Web Server (formerly Sun Java System Web Server or Sun ONE Web Server) 6.1 before SP12, and 7.0 through Update 6, when running on Windows, allows remote attackers to read arbitrary JSP files via an alternate data stream syntax, as…
MEDIUM 5.0EPSS 2.52%
Does this matter?
Lower severity and a low EPSS score (2.52%). Track it; it rarely justifies an emergency change on its own.
Description
Oracle iPlanet Web Server (formerly Sun Java System Web Server or Sun ONE Web Server) 6.1 before SP12, and 7.0 through Update 6, when running on Windows, allows remote attackers to read arbitrary JSP files via an alternate data stream syntax, as demonstrated by a .jsp::$DATA URI.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 2.52% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- sun/java system web server
- Source
- cve@mitre.org
References
- http://isowarez.de/SunOne_Webserver.txtExploit
- http://jvn.jp/en/jp/JVN47124169/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2009-002069
- http://secunia.com/advisories/35701Vendor Advisory
- http://securitytracker.com/id?1022511Exploit
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-266429-1Vendor Advisory
- http://www.osvdb.org/55655
- http://www.vupen.com/english/advisories/2009/1786Vendor Advisory
- http://isowarez.de/SunOne_Webserver.txtExploit
- http://jvn.jp/en/jp/JVN47124169/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2009-002069
- http://secunia.com/advisories/35701Vendor Advisory
- http://securitytracker.com/id?1022511Exploit
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-266429-1Vendor Advisory
- http://www.osvdb.org/55655
- http://www.vupen.com/english/advisories/2009/1786Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.