CVE-2007-3504
Status: ModifiedHigh (9.3)—
Directory traversal vulnerability in the PersistenceService in Sun Java Web Start in JDK and JRE 5.0 Update 11 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, for Windows allows remote attackers to perform unauthorized actions via an application that grants file overwrite privileges to itself. NOTE: this can be leveraged to execute arbitrary code by overwriting a .java.policy file.
CVSS
- Version: 2.0
- Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
- Base score: 9.3
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 6.42%
- Percentile among all scored CVEs: 94
- Score date: 10/13/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (3)
CWEs
- CWE-22
References
- http://docs.info.apple.com/article.html?artnum=307177
- http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html
- http://osvdb.org/37755
- http://secunia.com/advisories/25823
- http://secunia.com/advisories/28115
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102957-1
- http://www.securityfocus.com/archive/1/472673/100/0/threaded
- http://www.securityfocus.com/bid/24695
- http://www.securitytracker.com/id?1018328
- http://www.vupen.com/english/advisories/2007/2384
- http://www.vupen.com/english/advisories/2007/4224
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35169
- http://docs.info.apple.com/article.html?artnum=307177
- http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html
- http://osvdb.org/37755
- http://secunia.com/advisories/25823
- http://secunia.com/advisories/28115
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102957-1
- http://www.securityfocus.com/archive/1/472673/100/0/threaded
- http://www.securityfocus.com/bid/24695
- http://www.securitytracker.com/id?1018328
- http://www.vupen.com/english/advisories/2007/2384
- http://www.vupen.com/english/advisories/2007/4224
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35169
Raw JSON (NVD)
Show
{
"id": "CVE-2007-3504",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 9.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": true,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2007-06-30T01:30:00.000",
"references": [
{
"url": "http://docs.info.apple.com/article.html?artnum=307177",
"source": "cve@mitre.org"
},
{
"url": "http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html",
"source": "cve@mitre.org"
},
{
"url": "http://osvdb.org/37755",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/25823",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/28115",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102957-1",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/archive/1/472673/100/0/threaded",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/24695",
"source": "cve@mitre.org"
},
{
"url": "http://www.securitytracker.com/id?1018328",
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2007/2384",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2007/4224",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35169",
"source": "cve@mitre.org"
},
{
"url": "http://docs.info.apple.com/article.html?artnum=307177",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://osvdb.org/37755",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/25823",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/28115",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102957-1",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/472673/100/0/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/24695",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id?1018328",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2007/2384",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2007/4224",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35169",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in the PersistenceService in Sun Java Web Start in JDK and JRE 5.0 Update 11 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, for Windows allows remote attackers to perform unauthorized actions via an application that grants file overwrite privileges to itself. NOTE: this can be leveraged to execute arbitrary code by overwriting a .java.policy file."
},
{
"lang": "es",
"value": "Una vulnerabilidad de salto de directorio en PersistenceService en Sun Java Web Start en JDK y JRE versión 5.0 Update 11 y anteriores, y Java Web Start en SDK y JRE versión 1.4.2_13 y anteriores, para Windows, permite a atacantes remotos realizar acciones no autorizadas por medio de una aplicación que otorga privilegios de sobrescritura de archivos a sí mismo. NOTA: esto puede ser aprovechado para ejecutar código arbitrario sobrescribiendo un archivo .java.policy."
}
],
"lastModified": "2026-06-16T22:42:10.713",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2CF61F35-5905-4BA9-AD7E-7DB261D2F256"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sun:jdk:*:update11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "754E976F-B232-47C2-8AEB-09DD18A61173",
"versionEndIncluding": "1.5.0"
},
{
"criteria": "cpe:2.3:a:sun:jre:*:update13:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "237F087F-53C4-400D-B132-37BBEEA3E03D",
"versionEndIncluding": "1.4.2"
},
{
"criteria": "cpe:2.3:a:sun:jre:*:update11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CB640827-CF8F-481A-9603-B7AEEB4647E8",
"versionEndIncluding": "1.5.0"
},
{
"criteria": "cpe:2.3:a:sun:sdk:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "67142BE3-73D3-44D3-9B73-5952FEAA560A",
"versionEndIncluding": "1.4.2_13"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}