CVEvulnerability

CVE-2008-2945

7.5 HIGH Published 2008-06-30 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-06-30
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-20

Description

Sun Java System Access Manager 6.3 through 7.1 and Sun Java System Identity Server 6.1 and 6.2 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute arbitrary code via a crafted stylesheet, a related issue to CVE-2007-3715, CVE-2007-3716, and CVE-2007-4289.

Affected configurations

• sun java system access manager 6.3 • sun java system access manager 7.0 • sun java system access manager 7.1 • sun java system identity server 6.1 • sun java system identity server 6.2

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References