PT-2008-4382 · Sun · Sun Java System Access Manager+1

Published 2008-06-30 · Updated 2017-08-08 · CVE-2008-2945

Mitre

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Sun Java System Access Manager 6.3 through 7.1 and Sun Java System Identity Server 6.1 and 6.2 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute arbitrary code via a crafted stylesheet, a related issue to CVE-2007-3715, CVE-2007-3716, and CVE-2007-4289.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-2945

Affected Products

Sun Java System Access Manager

Java System Identity Server

References · 8

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-201538-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2945 · Security Note
• http://securityfocus.com/bid/29988 · Note
• http://support.avaya.com/elmodocs2/security/ASA-2008-294.htm · Note
• http://securitytracker.com/id?1020380 · Note
• http://secunia.com/advisories/30893 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43429 · Note
• http://vupen.com/english/advisories/2008/1967/references · Note