CVE-2007-3715 Sun Java System Application Server and Web Server 7.0 through 9.0 before 20070710 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attacker...
HighCVSS 9.3
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Sun Java System Application Server and Web Server 7.0 through 9.0 before 20070710 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute an arbitrary Java method via a crafted stylesheet, a related issue to CVE-2007-3716.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sun java system application server | = 8.2 | No fix listed |
| sun java system application server | = 9.0 | No fix listed |
| sun java system web server | = 7.0 | No fix listed |
References
- 37248 vdb-entry
- 26023 third-party-advisory vendor-advisory
- 102992 patch vendor-advisory
- 200054 vendor-advisory
- www.isecpartners.com
- www.isecpartners.com
- 20070712 Command Injection in XML Digital Signatures mailing-list
- 20070712 Whitepaper: Command Injection in XML Digital Signatures and Encryption mailing-list
- 24850 patch vdb-entry
- ADV-2007-2493 vdb-entry vendor-advisory
- ADV-2007-2785 vdb-entry vendor-advisory
- sunjava-xsltstylesheets-code-execution(35335) vdb-entry