CyberSec.Space Logo
返回 CVE 浏览器

CVE-2007-3715

CRITICAL
9.3
CVSS Severity Score
EPSS Score0.0580%
EPSS Percentile25.17th
Published2007年7月11日
Last Modified2026年4月23日

Vulnerability Description

Sun Java System Application Server and Web Server 7.0 through 9.0 before 20070710 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute an arbitrary Java method via a crafted stylesheet, a related issue to CVE-2007-3716.

Affected Platforms (CPE)

📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 8.2
📦
Sun

Java System Application Server

= 9.0
📦
Sun

Java System Application Server

= 9.0
📦
Sun

Java System Application Server

= 9.0
📦
Sun

Java System Application Server

= 9.0
📦
Sun

Java System Application Server

= 9.0
📦
Sun

Java System Web Server

= 7.0
📦
Sun

Java System Web Server

= 7.0
📦
Sun

Java System Web Server

= 7.0
📦
Sun

Java System Web Server

= 7.0
📦
Sun

Java System Web Server

= 7.0
📦
Sun

Java System Web Server

= 7.0

References & Advisories

🔗 http://osvdb.org/37248
🔗 http://secunia.com/advisories/26023
🔗 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102992-1
🔗 http://sunsolve.sun.com/search/document.do?assetkey=1-66-200054-1
🔗 http://www.isecpartners.com/advisories/2007-04-dsig.txt
🔗 http://www.isecpartners.com/files/XMLDSIG_Command_Injection.pdf
🔗 http://www.securityfocus.com/archive/1/473552/100/0/threaded
🔗 http://www.securityfocus.com/archive/1/473553/100/0/threaded

相关漏洞威胁

CVE-2011-080710.0

Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server ...

CVE-2021-271989.8

An issue was discovered in Visualware MyConnection Server before v11.1a. Unauthenticated Remote Code Execution can occur via Arbit...

CVE-2019-03459.8

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overv...

CVE-2020-261188.8

In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java...