CVE-2007-4289 Sun Java System Portal Server 7.0 does not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute an arbitrary Java method via a cr...
MediumCVSS 6.8
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Sun Java System Portal Server 7.0 does not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute an arbitrary Java method via a crafted stylesheet, a related issue to CVE-2007-3715.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sun java system portal server | = 7.0 | No fix listed |
References
- 26327 patch third-party-advisory vendor-advisory
- 1018513 vdb-entry
- 103015 patch vendor-advisory
- www.isecpartners.com
- www.isecpartners.com
- 20070712 Whitepaper: Command Injection in XML Digital Signatures and Encryption mailing-list
- sun-jsps-xslt-code-execution(35811) vdb-entry