Lucene search

[email protected]CVE-2009-2713

HistoryAug 07, 2009 - 7:00 p.m.

CVE-2009-2713

2009-08-0719:00:01

[email protected]

web.nvd.nist.gov

cdcservlet

sun java system access manager

cross domain single sign on

cdsso

cve-2009-2713

security vulnerability

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.9 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

74.7%

JSON

The CDCServlet component in Sun Java System Access Manager 7.0 2005Q4 and 7.1, when Cross Domain Single Sign On (CDSSO) is enabled, does not ensure that “policy advice” is presented to the correct client, which allows remote attackers to obtain sensitive information via unspecified vectors.

Affected configurations

NVD

Node

sunjava_system_access_managerMatch6.3_2005q1solaris_10_sparc

sunjava_system_access_managerMatch6.3_2005q1solaris_8_sparc

sunjava_system_access_managerMatch6.3_2005q1solaris_9_sparc

sunjava_system_access_managerMatch7.1solaris_10_sparc

sunjava_system_access_managerMatch7.1solaris_8_sparc

sunjava_system_access_managerMatch7.1solaris_9_sparc

sunjava_system_access_managerMatch7_2005q4solaris_10_sparc

sunjava_system_access_managerMatch7_2005q4solaris_8_sparc

sunjava_system_access_managerMatch7_2005q4solaris_9_sparc

Node

sunjava_system_access_managerMatch6.3_2005q1solaris_10_x86

sunjava_system_access_managerMatch6.3_2005q1solaris_8_x86

sunjava_system_access_managerMatch6.3_2005q1solaris_9_x86

sunjava_system_access_managerMatch7.1solaris_10_x86

sunjava_system_access_managerMatch7.1solaris_8_x86

sunjava_system_access_managerMatch7.1solaris_9_x86

sunjava_system_access_managerMatch7_2005q4solaris_10_x86

sunjava_system_access_managerMatch7_2005q4solaris_8_x86

sunjava_system_access_managerMatch7_2005q4solaris_9_x86

Node

sunjava_system_access_managerMatch6.3_2005q1solaris_10_linux

sunjava_system_access_managerMatch6.3_2005q1solaris_8_linux

sunjava_system_access_managerMatch6.3_2005q1solaris_9_linux

sunjava_system_access_managerMatch7.1solaris_10_linux

sunjava_system_access_managerMatch7.1solaris_8_linux

sunjava_system_access_managerMatch7.1solaris_9_linux

sunjava_system_access_managerMatch7_2005q4solaris_10_linux

sunjava_system_access_managerMatch7_2005q4solaris_8_linux

sunjava_system_access_managerMatch7_2005q4solaris_9_linux

Node

sunjava_system_access_managerMatch7.0_2005q4windows

sunjava_system_access_managerMatch7.1windows

Node

sunjava_system_web_serverMatch7.0hp_ux

Node

sunjava_system_access_managerMatch7.1war

CPENameOperatorVersion
sun:java_system_access_managersun java system access managereq6.3_2005q1
sun:java_system_access_managersun java system access managereq7.1
sun:java_system_access_managersun java system access managereq7_2005q4

CPE	Name	Operator	Version
sun:java_system_access_manager	sun java system access manager	eq	6.3_2005q1
sun:java_system_access_manager	sun java system access manager	eq	7.1
sun:java_system_access_manager	sun java system access manager	eq	7_2005q4