Login Request a demo
Unscored severity · published Jul 13, 2009
CVE-2009-2445
Oracle iPlanet Web Server (formerly Sun Java System Web Server or Sun ONE Web Server) 6.1 before SP12, and 7.0 through Update 6, when running on Windows, allows remote attackers…
–
CVSS
2.5%
EPSS
No
On KEV
Description
Oracle iPlanet Web Server (formerly Sun Java System Web Server or Sun ONE Web Server) 6.1 before SP12, and 7.0 through Update 6, when running on Windows, allows remote attackers to read arbitrary JSP files via an alternate data stream syntax, as demonstrated by a .jsp::$DATA URI.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Java System Web Server · Sun
6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +5 more · source: NVD
Affected product
JS
Java System Web Server
Sun
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2445
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2445
Exploit
http://isowarez.de/SunOne_Webserver.txt
jvn.jp
http://jvn.jp/en/jp/JVN47124169/index.html
jvndb.jvn.jp
http://jvndb.jvn.jp/jvndb/JVNDB-2009-002069
Vendor Advisory
http://secunia.com/advisories/35701
Exploit
http://securitytracker.com/id?1022511
Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-266429-1
More from Java System Web Server
–
CVE-2010-0389
The admin server in Sun Java System Web Server 7.0 Update 6 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an HTTP request…
–
CVE-2010-0388
Format string vulnerability in the WebDAV implementation in webservd in Sun Java System Web Server 7.0 Update 6 allows remote attackers to cause a denial of service (daemon crash)…
–
CVE-2010-0387
Multiple heap-based buffer overflows in (1) webservd and (2) the admin server in Sun Java System Web Server 7.0 Update 7 allow remote attackers to cause a denial of service…
–
CVE-2010-0361
Stack-based buffer overflow in the WebDAV implementation in webservd in Sun Java System Web Server (aka SJWS) 7.0 Update 7 allows remote attackers to cause a denial of service…
–
CVE-2010-0360
Sun Java System Web Server (aka SJWS) 7.0 Update 7 allows remote attackers to overwrite memory locations in the heap, and discover the contents of memory locations, via a…