CVE-2008-0628 : The XML parsing code in Sun Java Runtime Environment JDK and JRE 6 Update 3 and

The XML parsing code in Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier processes external entity references even when the "external general entities" property is false, which allows remote attackers to conduct XML external entity (XXE) attacks and cause a denial of service or access restricted resources.

Published 2008-02-06 21:00:00

Updated 2018-10-15 22:02:16

Source MITRE

View at NVD, CVE.org

Vulnerability category: XML external entity (XXE) injectionDenial of service

Products affected by CVE-2008-0628

SUN » JDK » Version: 1.6
cpe:2.3:a:sun:jdk:1.6:*:*:*:*:*:*:*
Matching versions
SUN » JRE » Update Update3
Versions up to, including, (<=) 1.6.0
cpe:2.3:a:sun:jre:*:update3:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2008-0628

Top countries where our scanners detected CVE-2008-0628

Top open port discovered on systems with this issue 80

IPs affected by CVE-2008-0628 719

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2008-0628!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2008-0628

EPSS FAQ

1.28%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 86 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2008-0628

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.8	HIGH	AV:N/AC:M/Au:N/C:N/I:P/A:C	8.6	7.8	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Complete

CWE ids for CVE-2008-0628

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2008-0628