CyberSec.Space Logo
Back to CVE Browser

CVE-2007-3715

CRITICAL
9.3
CVSS Severity Score
EPSS Score0.0580%
EPSS Percentile25.17th
PublishedJul 11, 2007
Last ModifiedApr 23, 2026

Vulnerability Description

Sun Java System Application Server and Web Server 7.0 through 9.0 before 20070710 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute an arbitrary Java method via a crafted stylesheet, a related issue to CVE-2007-3716.

Affected Platforms (CPE)

📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 9.0
📦
Sun

Java System Application Server

= 9.0
📦
Sun

Java System Application Server

= 9.0
📦
Sun

Java System Application Server

= 9.0
📦
Sun

Java System Application Server

= 9.0
📦
Sun

Java System Web Server

= 7.0
📦
Sun

Java System Web Server

= 7.0
📦
Sun

Java System Web Server

= 7.0
📦
Sun

Java System Web Server

= 7.0
📦
Sun

Java System Web Server

= 7.0
📦
Sun

Java System Web Server

= 7.0

References & Advisories

🔗 http://osvdb.org/37248
🔗 http://secunia.com/advisories/26023
🔗 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102992-1
🔗 http://sunsolve.sun.com/search/document.do?assetkey=1-66-200054-1
🔗 http://www.isecpartners.com/advisories/2007-04-dsig.txt
🔗 http://www.isecpartners.com/files/XMLDSIG_Command_Injection.pdf
🔗 http://www.securityfocus.com/archive/1/473552/100/0/threaded
🔗 http://www.securityfocus.com/archive/1/473553/100/0/threaded

Related Vulnerabilities

CVE-2011-080710.0

Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server ...

CVE-2021-271989.8

An issue was discovered in Visualware MyConnection Server before v11.1a. Unauthenticated Remote Code Execution can occur via Arbit...

CVE-2019-03459.8

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overv...

CVE-2020-261188.8

In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java...