CVE-2008-2945

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

2.80%

Published

Jun 30, 2008

Modified

Jun 16, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Sun Java System Access Manager 6.3 through 7.1 and Sun Java System Identity Server 6.1 and 6.2 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute arbitrary code via a crafted stylesheet, a related issue to CVE-2007-3715, CVE-2007-3716, and CVE-2007-4289.

Weaknesses (CWE)

CWE-20

Affected Products (5)

sun · java_system_access_managervulnerable

sun · java_system_identity_servervulnerable

References (14)

http://secunia.com/advisories/30893

http://sunsolve.sun.com/search/document.do?assetkey=1-26-201538-1

http://support.avaya.com/elmodocs2/security/ASA-2008-294.htm

http://www.securityfocus.com/bid/29988

http://www.securitytracker.com/id?1020380

http://www.vupen.com/english/advisories/2008/1967/references