VulnerabilityModified
CVE-2009-2713
The CDCServlet component in Sun Java System Access Manager 7.0 2005Q4 and 7.1, when Cross Domain Single Sign On (CDSSO) is enabled, does not ensure that "policy advice" is presented to the correct client, which allows remote attackers to obtain…
MEDIUM 4.3EPSS 1.71%
Does this matter?
Lower severity and a low EPSS score (1.71%). Track it; it rarely justifies an emergency change on its own.
Description
The CDCServlet component in Sun Java System Access Manager 7.0 2005Q4 and 7.1, when Cross Domain Single Sign On (CDSSO) is enabled, does not ensure that "policy advice" is presented to the correct client, which allows remote attackers to obtain sensitive information via unspecified vectors.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 1.71% probability · 76th percentile
- CISA KEV
- Not listed
- Affected
- sun/java system access manager · sun/java system web server
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/36167Vendor Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-03-1Patch
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-255968-1Vendor Advisory
- http://www.securityfocus.com/bid/35961Patch
- http://www.vupen.com/english/advisories/2009/2176
- http://secunia.com/advisories/36167Vendor Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-03-1Patch
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-255968-1Vendor Advisory
- http://www.securityfocus.com/bid/35961Patch
- http://www.vupen.com/english/advisories/2009/2176
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.