Home > Vulnerability Database > CVE-2009-2672

Mend.io Vulnerability Database

CVE-2009-2672

Date: August 5, 2009

The proxy mechanism implementation in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15, and JDK and JRE 5.0 before Update 20, does not prevent access to browser cookies by untrusted (1) applets and (2) Java Web Start applications, which allows remote attackers to hijack web sessions via unspecified vectors.

Severity Score

7.3

Related Resources (34)

Url: http://www.vupen.com/english/advisories/2009/2543

Url: http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html

Url: http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html

Url: http://www.vupen.com/english/advisories/2009/3316

Url: http://sunsolve.sun.com/search/document.do?assetkey=1-66-263409-1

Url: https://rhn.redhat.com/errata/RHSA-2009-1200.html

Url: http://secunia.com/advisories/36176

Url: http://secunia.com/advisories/37386

Url: http://secunia.com/advisories/37300

Url: http://secunia.com/advisories/36199

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9359

Url: http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html

Url: http://secunia.com/advisories/36180

Url: http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20

Url: http://java.sun.com/javase/6/webnotes/6u15.html

Url: http://www.securitytracker.com/id?1022659

Url: https://exchange.xforce.ibmcloud.com/vulnerabilities/52337

Url: https://rhn.redhat.com/errata/RHSA-2009-1199.html

Url: https://rhn.redhat.com/errata/RHSA-2009-1201.html

Url: http://marc.info/?l=bugtraq&m=125787273209737&w=2

Url: http://security.gentoo.org/glsa/glsa-200911-02.xml

Url: http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00003.html

Url: http://www.us-cert.gov/cas/techalerts/TA09-294A.html

Url: http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1

Url: http://www.vmware.com/security/advisories/VMSA-2009-0016.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2009-2672

Url: http://www.securityfocus.com/archive/1/507985/100/0/threaded

Url: http://secunia.com/advisories/36248

Url: http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html

Url: https://access.redhat.com/security/cve/CVE-2009-2672

Url: http://www.securityfocus.com/bid/35943

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7723

Url: http://secunia.com/advisories/37460

Url: https://www.mend.io/vulnerability-database/CVE-2009-2672

Severity Score

7.3

Weakness Type (CWE)

Permissions, Privileges, and Access Control

CWE-264

CVSS v3.1

Base Score:	7.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW

CVSS v2

Base Score:	7.5
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2009-2672

Date: August 5, 2009

Severity Score

Related Resources (34)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?