Unscored severity · published Mar 25, 2009
CVE-2009-1104
The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; and 1.4.2_19 and earlier does not prevent…
–
CVSS
2.2%
EPSS
No
On KEV
Description
The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; and 1.4.2_19 and earlier does not prevent Javascript that is loaded from the localhost from connecting to other ports on the system, which allows user-assisted attackers to bypass intended access restrictions via LiveConnect, aka CR 6724331. NOTE: this vulnerability can be leveraged with separate cross-site scripting (XSS) vulnerabilities for remote attack vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
Java · Sun
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-1104
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-1104
h20000.www2.hp.com
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00001.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html
marc.info
http://marc.info/?l=bugtraq&m=124344236532162&w=2
secunia.com
http://secunia.com/advisories/34495
More from Java
–
CVE-2010-0887
Unspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business JDK and JRE 6 Update 18 and 19 allows remote attackers to affect…
–
CVE-2009-1107
The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier, and 5.0 Update 17 and earlier, allows remote attackers to trick a…
–
CVE-2009-1105
The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 allows user-assisted remote attackers to cause a trusted applet to run…
–
CVE-2009-1103
Unspecified vulnerability in the Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4.2_19 and…
–
CVE-2009-1102
Unspecified vulnerability in the Virtual Machine in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to access…