CVE-2009-2445observed exploitation

CVE-2009-2445

Published 13 Jul 2009 · Updated 07 Aug 2024

25Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Attendepss 2.5%

from disclosure to weapon

Published on NVDJul 13

VulnCheck+5412d

exploitation probability

2.5%top 16% of all CVEs

observed exploitation

yesVulnCheck

Oracle iPlanet Web Server (formerly Sun Java System Web Server or Sun ONE Web Server) 6.1 before SP12, and 7.0 through Update 6, when running on Windows, allows remote attackers to read arbitrary JSP files via an alternate data stream syntax, as demonstrated by a .jsp::$DATA URI.

Affected products

n/a · n/a

References

http://isowarez.de/SunOne_Webserver.txt http://jvndb.jvn.jp/jvndb/JVNDB-2009-002069 http://jvn.jp/en/jp/JVN47124169/index.html http://secunia.com/advisories/35701 http://securitytracker.com/id?1022511 http://sunsolve.sun.com/search/document.do?assetkey=1-26-266429-1 http://www.osvdb.org/55655 http://www.vupen.com/english/advisories/2009/1786