CVE-2009-2445

2009-07-1317:30:00

CWE-200

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

0.199

Percentile

96.4%

JSON

Oracle iPlanet Web Server (formerly Sun Java System Web Server or Sun ONE Web Server) 6.1 before SP12, and 7.0 through Update 6, when running on Windows, allows remote attackers to read arbitrary JSP files via an alternate data stream syntax, as demonstrated by a .jsp::$DATA URI.

Affected configurations

Nvd

Node

sunjava_system_web_serverMatch6.1windows

sunjava_system_web_serverMatch6.1sp10windows

sunjava_system_web_serverMatch6.1sp11windows

sunjava_system_web_serverMatch6.1sp4windows

sunjava_system_web_serverMatch6.1sp5windows

sunjava_system_web_serverMatch6.1sp6windows

sunjava_system_web_serverMatch6.1sp7windows

sunjava_system_web_serverMatch6.1sp8windows

sunjava_system_web_serverMatch6.1sp9windows

sunjava_system_web_serverMatch7.0update_5windows

sunjava_system_web_serverMatch7.0update_6windows

VendorProductVersionCPE
sunjava_system_web_server6.1cpe:2.3:a:sun:java_system_web_server:6.1:*:windows:*:*:*:*:*
sunjava_system_web_server6.1cpe:2.3:a:sun:java_system_web_server:6.1:sp10:windows:*:*:*:*:*
sunjava_system_web_server6.1cpe:2.3:a:sun:java_system_web_server:6.1:sp11:windows:*:*:*:*:*
sunjava_system_web_server6.1cpe:2.3:a:sun:java_system_web_server:6.1:sp4:windows:*:*:*:*:*
sunjava_system_web_server6.1cpe:2.3:a:sun:java_system_web_server:6.1:sp5:windows:*:*:*:*:*
sunjava_system_web_server6.1cpe:2.3:a:sun:java_system_web_server:6.1:sp6:windows:*:*:*:*:*
sunjava_system_web_server6.1cpe:2.3:a:sun:java_system_web_server:6.1:sp7:windows:*:*:*:*:*
sunjava_system_web_server6.1cpe:2.3:a:sun:java_system_web_server:6.1:sp8:windows:*:*:*:*:*
sunjava_system_web_server6.1cpe:2.3:a:sun:java_system_web_server:6.1:sp9:windows:*:*:*:*:*
sunjava_system_web_server7.0cpe:2.3:a:sun:java_system_web_server:7.0:update_5:windows:*:*:*:*:*

Vendor	Product	Version	CPE
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1::windows:::::
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp10:windows:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp11:windows:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp4:windows:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp5:windows:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp6:windows:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp7:windows:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp8:windows:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp9:windows:::::*
sun	java_system_web_server	7.0	cpe:2.3:a:sun:java_system_web_server:7.0:update_5:windows:::::*