Lucene search

[email protected]CVE-2006-6276

HistoryDec 04, 2006 - 11:28 a.m.

CVE-2006-6276

2006-12-0411:28:00

CWE-444

[email protected]

web.nvd.nist.gov

cve-2006-6276

http request smuggling

sun java system proxy server

sun java system application server

sun java system web server

security vulnerability

web sessions hijacking

cross-site scripting

xss

web cache poisoning

6.5 Medium

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.013 Low

EPSS

Percentile

85.6%

JSON

HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting (XSS), and poison web caches via unspecified attack vectors.

Affected configurations

NVD

Node

sunjava_system_application_serverMatch7.0

sunjava_system_application_serverMatch8.1

sunjava_system_web_proxy_serverMatch-

sunjava_system_web_proxy_serverMatch3.6

sunjava_system_web_proxy_serverMatch4.0

sunjava_system_web_serverMatch6.0

sunjava_system_web_serverMatch6.1

sunone_application_serverMatch7.0

CPENameOperatorVersion
sun:java_system_application_serversun java system application servereq7.0
sun:java_system_application_serversun java system application servereq8.1
sun:java_system_web_proxy_serversun java system web proxy servereq-
sun:java_system_web_proxy_serversun java system web proxy servereq3.6
sun:java_system_web_proxy_serversun java system web proxy servereq4.0
sun:java_system_web_serversun java system web servereq6.0
sun:java_system_web_serversun java system web servereq6.1
sun:one_application_serversun one application servereq7.0

CPE	Name	Operator	Version
sun:java_system_application_server	sun java system application server	eq	7.0
sun:java_system_application_server	sun java system application server	eq	8.1
sun:java_system_web_proxy_server	sun java system web proxy server	eq	-
sun:java_system_web_proxy_server	sun java system web proxy server	eq	3.6
sun:java_system_web_proxy_server	sun java system web proxy server	eq	4.0
sun:java_system_web_server	sun java system web server	eq	6.0
sun:java_system_web_server	sun java system web server	eq	6.1
sun:one_application_server	sun one application server	eq	7.0

References

secunia.com/advisories/23186

securitytracker.com/id?1017322

securitytracker.com/id?1017323

securitytracker.com/id?1017324

sunsolve.sun.com/search/document.do?assetkey=1-26-102733-1

www.securityfocus.com/bid/21371

www.vupen.com/english/advisories/2006/4793

exchange.xforce.ibmcloud.com/vulnerabilities/30662

6.5 Medium

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.013 Low

EPSS

Percentile

85.6%

JSON

Related for CVE-2006-6276

nvd1 cvelist1