CVE-2007-3715 : Sun Java System Application Server and Web Server 7.0 through 9.0 before 2007071

Sun Java System Application Server and Web Server 7.0 through 9.0 before 20070710 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute an arbitrary Java method via a crafted stylesheet, a related issue to CVE-2007-3716.

Published 2007-07-11 23:30:00

Updated 2018-10-15 21:29:58

Source MITRE

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2007-3715

SUN » Java System Web Server » Version: 7.0
cpe:2.3:a:sun:java_system_web_server:7.0:*:*:*:*:*:*:*
Matching versions
SUN » Java System Web Server » Version: 7.0 Sparc Edition
cpe:2.3:a:sun:java_system_web_server:7.0:*:sparc:*:*:*:*:*
Matching versions
SUN » Java System Web Server » Version: 7.0 X86 Edition
cpe:2.3:a:sun:java_system_web_server:7.0:*:x86:*:*:*:*:*
Matching versions
SUN » Java System Web Server » Version: 7.0 Linux Edition
cpe:2.3:a:sun:java_system_web_server:7.0:*:linux:*:*:*:*:*
Matching versions
SUN » Java System Web Server » Version: 7.0 Hp Ux Edition
cpe:2.3:a:sun:java_system_web_server:7.0:*:hp_ux:*:*:*:*:*
Matching versions
SUN » Java System Web Server » Version: 7.0 Windows Edition
cpe:2.3:a:sun:java_system_web_server:7.0:*:windows:*:*:*:*:*
Matching versions
SUN » Java System Application Server » Version: 8.2 Platform Edition
cpe:2.3:a:sun:java_system_application_server:8.2:*:platform:*:*:*:*:*
Matching versions
SUN » Java System Application Server » Version: 9.0 Platform Edition
cpe:2.3:a:sun:java_system_application_server:9.0:*:platform:*:*:*:*:*
Matching versions
SUN » Java System Application Server » Version: 8.2 Platform Windows Edition
cpe:2.3:a:sun:java_system_application_server:8.2:*:platform_windows:*:*:*:*:*
Matching versions
SUN » Java System Application Server » Version: 8.2 Enterprise Sparc Edition
cpe:2.3:a:sun:java_system_application_server:8.2:*:enterprise_sparc:*:*:*:*:*
Matching versions
SUN » Java System Application Server » Version: 9.0 Platform Windows Edition
cpe:2.3:a:sun:java_system_application_server:9.0:*:platform_windows:*:*:*:*:*
Matching versions
SUN » Java System Application Server » Version: 8.2 Enterprise X86 Edition
cpe:2.3:a:sun:java_system_application_server:8.2:*:enterprise_x86:*:*:*:*:*
Matching versions
SUN » Java System Application Server » Version: 8.2 Enterprise Linux Edition
cpe:2.3:a:sun:java_system_application_server:8.2:*:enterprise_linux:*:*:*:*:*
Matching versions
SUN » Java System Application Server » Version: 8.2 Platform Sparc Edition
cpe:2.3:a:sun:java_system_application_server:8.2:*:platform_sparc:*:*:*:*:*
Matching versions
SUN » Java System Application Server » Version: 8.2 Enterprise Windows Edition
cpe:2.3:a:sun:java_system_application_server:8.2:*:enterprise_windows:*:*:*:*:*
Matching versions
SUN » Java System Application Server » Version: 9.0 Platform Sparc Edition
cpe:2.3:a:sun:java_system_application_server:9.0:*:platform_sparc:*:*:*:*:*
Matching versions
SUN » Java System Application Server » Version: 8.2 Enterprise Edition
cpe:2.3:a:sun:java_system_application_server:8.2:*:enterprise:*:*:*:*:*
Matching versions
SUN » Java System Application Server » Version: 8.2 Platform X86 Edition
cpe:2.3:a:sun:java_system_application_server:8.2:*:platform_x86:*:*:*:*:*
Matching versions
SUN » Java System Application Server » Version: 8.2 Platform Linux Edition
cpe:2.3:a:sun:java_system_application_server:8.2:*:platform_linux:*:*:*:*:*
Matching versions
SUN » Java System Application Server » Version: 9.0 Platform X86 Edition
cpe:2.3:a:sun:java_system_application_server:9.0:*:platform_x86:*:*:*:*:*
Matching versions
SUN » Java System Application Server » Version: 9.0 Platform Linux Edition
cpe:2.3:a:sun:java_system_application_server:9.0:*:platform_linux:*:*:*:*:*
Matching versions

Threat overview for CVE-2007-3715

Top countries where our scanners detected CVE-2007-3715

Top open port discovered on systems with this issue 80

IPs affected by CVE-2007-3715 130

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2007-3715!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2007-3715

EPSS FAQ

2.42%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 90 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2007-3715

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2007-3715

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2007-3715

Jump to