CVE-2009-2713
Estado: ModificadaMedia (4.3)—
The CDCServlet component in Sun Java System Access Manager 7.0 2005Q4 and 7.1, when Cross Domain Single Sign On (CDSSO) is enabled, does not ensure that "policy advice" is presented to the correct client, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
- Puntuación base: 4.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.71%
- Percentil entre todas las CVEs puntuadas: 77
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- NVD-CWE-noinfo
Referencias
- http://secunia.com/advisories/36167
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-03-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-255968-1
- http://www.securityfocus.com/bid/35961
- http://www.vupen.com/english/advisories/2009/2176
- http://secunia.com/advisories/36167
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-03-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-255968-1
- http://www.securityfocus.com/bid/35961
- http://www.vupen.com/english/advisories/2009/2176
JSON original (NVD)
Mostrar
{
"id": "CVE-2009-2713",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2009-08-07T19:00:01.140",
"references": [
{
"url": "http://secunia.com/advisories/36167",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-03-1",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-255968-1",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/35961",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2009/2176",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/36167",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-03-1",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-255968-1",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/35961",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2009/2176",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The CDCServlet component in Sun Java System Access Manager 7.0 2005Q4 and 7.1, when Cross Domain Single Sign On (CDSSO) is enabled, does not ensure that \"policy advice\" is presented to the correct client, which allows remote attackers to obtain sensitive information via unspecified vectors."
},
{
"lang": "es",
"value": "El componente CDCServlet en Sun Java System Access Manager v7.0 2005Q4 y v7.1, cuando Cross Domain Single Sign On (CDSSO) está habilitado, no garantiza que \"policy advice\" (aviso de políticas) se presenta al cliente correcto, lo cual permite a un atacante remoto obtener información sensible a través de vectores no especificados."
}
],
"lastModified": "2026-06-16T23:10:05.220",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_10_sparc:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8ED84EE5-2C53-4A8E-98B7-4F9181D4E192"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_8_sparc:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BF718ABC-42C7-4FE1-82A0-00F3506F1D42"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_9_sparc:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F590A1DC-7E1B-44CF-83D2-3FEDA91765C3"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_10_sparc:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "28F24915-078C-4E4B-B173-671F0ABF9656"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_8_sparc:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CAABA44E-5FD1-4B71-A4DE-9DC671DD8223"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_9_sparc:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2A857F82-4146-48E9-8568-19393AC3856B"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_10_sparc:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B56B9BD3-2708-46C3-850D-865599F88BF9"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_8_sparc:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B6391170-5831-4303-85E5-A51BB431E788"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_9_sparc:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "745D8651-B97C-48A9-AE4F-603A34516919"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_10_x86:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B0617E1B-FE70-442E-AEE6-BACC8515F005"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_8_x86:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2BC5828-0EF1-4640-91BF-9CC1E5FC6243"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_9_x86:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9096D748-9527-4061-8106-526741831F35"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_10_x86:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD06B92E-C23C-4648-A585-14FC54538FA2"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_8_x86:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4930E838-993A-4DA1-B504-4675EE20CF69"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_9_x86:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2D28C8EF-7525-48A0-A13A-EA95479A3B35"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_10_x86:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "207157F9-0AE4-45FB-A3DC-90C1F6E5376E"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_8_x86:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E8B1333-125A-44F7-A6C3-4B04D3FC9A8D"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_9_x86:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "92BC8B61-3F58-43B3-9756-616376D4D2DC"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_10_linux:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B9D7AA3C-6565-4291-A76F-3BE9311B77F3"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_8_linux:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "95ADB790-EF2D-4613-9F69-F37401518511"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_9_linux:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E64CD07-4AF7-49C4-A3C0-EE2BF9E067A5"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_10_linux:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8C9CC43-EFB5-4192-81F2-0373961A7078"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_8_linux:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "479657F1-8950-4C6C-9CD2-5FE3DF235E24"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_9_linux:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6F238642-873A-4A50-BF14-6B173A20A36D"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_10_linux:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3DA96674-2050-4686-A592-F450655073E8"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_8_linux:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5382933D-E32D-47F5-8892-65B94E06BD15"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_9_linux:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "644C3EA4-607C-42E7-805B-8F2EF6AF694E"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7.0_2005q4:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B7821A43-2549-4B75-A201-95A3AC58E8BF"
},
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7.1:*:windows:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36C5F1CB-FEDE-4C19-B056-C846C86FDE8E"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sun:java_system_web_server:7.0:*:hp_ux:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "134929FE-2EBA-4B55-904F-111A658160F3"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sun:java_system_access_manager:7.1:*:war:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "72304F6F-83F9-4207-93D9-6886AD9E88A1"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}