CVE-2007-1526

Sun Java System Web Server 6.1 before 20070314 allows remote authenticated users with revoked client certificates to bypass the Certificate Revocation List (CRL) authorization control and access secure web server instances running under an account different from that used for the admin server via unspecified vectors.

CVSS v2.0 6.0 MEDIUM

6.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 6.8 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://osvdb.org/34074
http://secunia.com/advisories/24531
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102822-1	Patch Vendor Advisory
http://www.securitytracker.com/id?1017777
http://www.vupen.com/english/advisories/2007/0958

Configurations

Configuration 1 (hide)

cpe:2.3:a:sun:java_system_web_server:6.1:*:*:*:*:*:*:*

History

No history.

Information

Published : 2007-03-20 20:19

Updated : 2023-12-10 10:40

NVD link : CVE-2007-1526

Mitre link : CVE-2007-1526

CVE.ORG link : CVE-2007-1526

JSON object : View

Products Affected

sun

java_system_web_server

CWE

NVD-CWE-Other

{"id": "CVE-2007-1526", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2007-03-20T20:19:00.000", "references": [{"url": "http://osvdb.org/34074", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/24531", "source": "cve@mitre.org"}, {"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102822-1", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id?1017777", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2007/0958", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Sun Java System Web Server 6.1 before 20070314 allows remote authenticated users with revoked client certificates to bypass the Certificate Revocation List (CRL) authorization control and access secure web server instances running under an account different from that used for the admin server via unspecified vectors."}, {"lang": "es", "value": "El Servidor Web Sun Java System 6.1 anterior al 20070314 permite a usuarios remotos autenticados con certificados de cliente revocados, evitar el control CRL (Lista de Certificados Revocados) y acceder a instancias seguras del servidor web que corren bajo cuentas diferentes de la utilizado por el administrador del servidor mediante vectores sin especificar."}], "lastModified": "2011-03-08T02:52:17.470", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sun:java_system_web_server:6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "044D96F6-7A18-4295-A665-16F1A6630963"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}