Vulnerability CVE-2007-6569 - CERT Civis.Net

Vulnerability Name:

CVE-2007-6569 (CCN-39205)

Assigned:

2007-12-21

Published:

2007-12-21

Updated:

2011-03-08

Summary:

Cross-site scripting (XSS) vulnerability in the View Error Log functionality in Sun Java System Web Proxy Server 4.x before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka BugID 6566246.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2007-6569

Source: CONFIRM
Type: UNKNOWN
http://docs.sun.com/app/docs/doc/820-2499/aeaaa?a=view

Source: CCN
Type: SA28186
Sun Java System Web Proxy Server Multiple Vulnerabilities

Source: SECUNIA
Type: Patch
28186

Source: CCN
Type: SA28216
Sun Java System Web Server / Web Proxy Server Cross-Site Scripting

Source: SECUNIA
Type: UNKNOWN
28216

Source: CCN
Type: Sun Alert ID: 103002
Cross-site Scripting Vulnerability in Sun Java System Web Server and Web Proxy Server

Source: SUNALERT
Type: Patch
103002

Source: CCN
Type: ASA-2008-002
Cross-site Scripting Vulnerability in Sun Java System Web Server and Web Proxy Server (Sun 103002)

Source: CCN
Type: OSVDB ID: 40848
Sun Java System Web Proxy Server View Error Log Functionality XSS

Source: BID
Type: Patch
26978

Source: CCN
Type: BID-26978
Sun Java Web Proxy Server and Sun Java Web Server Multiple Cross-Site Scripting Vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2007-4313

Source: XF
Type: UNKNOWN
javasystem-proxy-errorlog-xss(39205)

Vulnerable Configuration:

Configuration 1:

cpe:/a:sun:java_system_web_proxy_server:3.6:*:aix:*:*:*:*:*

OR cpe:/a:sun:java_system_web_proxy_server:3.6:*:hp_ux:*:*:*:*:*

OR cpe:/a:sun:java_system_web_proxy_server:3.6:*:sparc:*:*:*:*:*

OR cpe:/a:sun:java_system_web_proxy_server:3.6:*:windows:*:*:*:*:*

OR cpe:/a:sun:java_system_web_proxy_server:*:*:hp_ux:*:*:*:*:* (Version <= 4.0.6)

OR cpe:/a:sun:java_system_web_proxy_server:*:*:linux:*:*:*:*:* (Version <= 4.0.6)

OR cpe:/a:sun:java_system_web_proxy_server:*:*:sparc:*:*:*:*:* (Version <= 4.0.6)

OR cpe:/a:sun:java_system_web_proxy_server:*:*:windows:*:*:*:*:* (Version <= 4.0.6)

OR cpe:/a:sun:java_system_web_proxy_server:*:*:x86:*:*:*:*:* (Version <= 4.0.6)

OR cpe:/a:sun:java_system_web_server:6.1:*:aix:*:*:*:*:*

OR cpe:/a:sun:java_system_web_server:6.1:*:hp_ux:*:*:*:*:*

OR cpe:/a:sun:java_system_web_server:6.1:*:linux:*:*:*:*:*

OR cpe:/a:sun:java_system_web_server:6.1:*:sparc:*:*:*:*:*

OR cpe:/a:sun:java_system_web_server:6.1:*:windows:*:*:*:*:*

OR cpe:/a:sun:java_system_web_server:6.1:*:x86:*:*:*:*:*

OR cpe:/a:sun:java_system_web_server:7.0:*:hp_ux:*:*:*:*:*

OR cpe:/a:sun:java_system_web_server:7.0:*:linux:*:*:*:*:*

OR cpe:/a:sun:java_system_web_server:7.0:*:sparc:*:*:*:*:*

OR cpe:/a:sun:java_system_web_server:7.0:*:windows:*:*:*:*:*

OR cpe:/a:sun:java_system_web_server:7.0:*:x86:*:*:*:*:*

Configuration CCN 1:

cpe:/a:sun:java_system_web_server:6.1:*:*:*:*:*:*:*

OR cpe:/a:sun:java_system_web_proxy_server:3.6:*:*:*:*:*:*:*

OR cpe:/a:sun:java_system_web_server:7.0:*:*:*:*:*:*:*

OR cpe:/a:sun:java_system_web_proxy_server:4.0:*:*:*:*:*:*:*

OR cpe:/a:sun:java_system_web_proxy_server:4.0.6:*:*:*:*:*:*:*

AND

cpe:/o:sun:solaris:::x86:*:*:*:*:*

OR cpe:/o:sun:solaris:10.0::sparc:*:*:*:*:*

Denotes that component is vulnerable