Unscored severity · published Jul 11, 2007
CVE-2007-3715
Sun Java System Application Server and Web Server 7.0 through 9.0 before 20070710 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows…
–
CVSS
2.3%
EPSS
No
On KEV
Description
Sun Java System Application Server and Web Server 7.0 through 9.0 before 20070710 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute an arbitrary Java method via a crafted stylesheet, a related issue to CVE-2007-3716.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Java System Application Server · Sun
8.2; 8.2; 8.2; 8.2; 8.2; 8.2; +9 more · source: NVD
JS
Java System Web Server · Sun
7.0; 7.0; 7.0; 7.0; 7.0; 7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-3715
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-3715
osvdb.org
http://osvdb.org/37248
Vendor Advisory
http://secunia.com/advisories/26023
Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102992-1
Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200054-1
www.isecpartners.com
http://www.isecpartners.com/advisories/2007-04-dsig.txt
www.isecpartners.com
http://www.isecpartners.com/files/XMLDSIG_Command_Injection.pdf
More from Java System Application Server
8.1
CVE-2010-0386
The default configuration of Sun Java System Application Server 7 and 7 2004Q2 enables the HTTP TRACE method, which makes it easier for remote attackers to steal cookies and…
–
CVE-2012-3155
Unspecified vulnerability in the CORBA ORB component in Sun GlassFish Enterprise Server 2.1.1, Oracle GlassFish Server 3.0.1 and 3.1.2, and Sun Java System Application Server 8.1…
–
CVE-2011-0807
Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allows remote attackers to affect…
–
CVE-2009-0278
Sun Java System Application Server (AS) 8.1 and 8.2 allows remote attackers to read the Web Application configuration files in the (1) WEB-INF or (2) META-INF directory via a…
–
CVE-2008-5266
Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java System Application Server 9.1_01 build…