CVE-2008-2945

2008-06-3022:41:00

CWE-20

[email protected]

web.nvd.nist.gov

sun java system

access manager

identity server

xml signature

vulnerability

xslt

cve-2008-2945

nvd

9.4 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.012 Low

EPSS

Percentile

85.0%

JSON

Sun Java System Access Manager 6.3 through 7.1 and Sun Java System Identity Server 6.1 and 6.2 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute arbitrary code via a crafted stylesheet, a related issue to CVE-2007-3715, CVE-2007-3716, and CVE-2007-4289.

CPENameOperatorVersion
sun:java_system_identity_serversun java system identity servereq6.2
sun:java_system_access_managersun java system access managereq7.1
sun:java_system_access_managersun java system access managereq6.3
sun:java_system_identity_serversun java system identity servereq6.1
sun:java_system_access_managersun java system access managereq7.0

CPE	Name	Operator	Version
sun:java_system_identity_server	sun java system identity server	eq	6.2
sun:java_system_access_manager	sun java system access manager	eq	7.1
sun:java_system_access_manager	sun java system access manager	eq	6.3
sun:java_system_identity_server	sun java system identity server	eq	6.1
sun:java_system_access_manager	sun java system access manager	eq	7.0