CVE-2007-2435

javaws vulnerabilities

Severity Score

9.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to support for JNLP files.

Sun Java Web Start en JDK y JRE 5.0 hasta 10 y anteriores, y Java Web Start en SDK y JRE 1.4.2_13 y anteriores, permite a atacantes remotos realizar acciones no autorizadas a través de una aplicación que concede privilegios a si mismo, relacionado con "Uso incorrecto de sistemas de clases" y probablemente relacionado con el apoyo para ficheros JNLP.

Multiple vulnerabilities have been identified in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE). Versions less than 1.6.0.05 are affected.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-05-01 CVE Reserved
2007-05-02 CVE Published
2024-08-07 CVE Updated
2025-05-27 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-264: Permissions, Privileges, and Access Controls

CAPEC

References (33)

URL	Tag	Source
http://docs.info.apple.com/article.html?artnum=307177	X_refsource_misc
http://osvdb.org/35483	Vdb Entry
http://secunia.com/advisories/25283	Third Party Advisory
http://secunia.com/advisories/25413	Third Party Advisory
http://secunia.com/advisories/25474	Third Party Advisory
http://secunia.com/advisories/25832	Third Party Advisory
http://secunia.com/advisories/26311	Third Party Advisory
http://secunia.com/advisories/26369	Third Party Advisory
http://secunia.com/advisories/28115	Third Party Advisory
http://secunia.com/advisories/29858	Third Party Advisory
http://secunia.com/advisories/30780	Third Party Advisory
http://support.avaya.com/elmodocs2/security/ASA-2007-199.htm	X_refsource_confirm
http://www.securitytracker.com/id?1017986	Vdb Entry
http://www.vupen.com/english/advisories/2007/1598	Vdb Entry
http://www.vupen.com/english/advisories/2007/1814	Vdb Entry
http://www.vupen.com/english/advisories/2007/4224	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/33984	Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10999	Signature

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/25069	2017-10-11
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102881-1	2017-10-11
http://www.securityfocus.com/bid/23728	2017-10-11

URL	Date	SRC
http://dev2dev.bea.com/pub/advisory/241	2017-10-11
http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html	2017-10-11
http://security.gentoo.org/glsa/glsa-200706-08.xml	2017-10-11
http://security.gentoo.org/glsa/glsa-200804-28.xml	2017-10-11
http://www.gentoo.org/security/en/glsa/glsa-200705-23.xml	2017-10-11
http://www.gentoo.org/security/en/glsa/glsa-200804-20.xml	2017-10-11
http://www.gentoo.org/security/en/glsa/glsa-200806-11.xml	2017-10-11
http://www.redhat.com/support/errata/RHSA-2007-0817.html	2017-10-11
http://www.redhat.com/support/errata/RHSA-2007-0829.html	2017-10-11
http://www.redhat.com/support/errata/RHSA-2008-0261.html	2017-10-11
https://access.redhat.com/security/cve/CVE-2007-2435	2008-06-30
https://bugzilla.redhat.com/show_bug.cgi?id=239660	2008-06-30

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Sun Search vendor "Sun"		Java Enterprise System Search vendor "Sun" for product "Java Enterprise System"				<= 5.0 Search vendor "Sun" for product "Java Enterprise System" and version " <= 5.0"		update10		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				<= 1.4.2 Search vendor "Sun" for product "Jre" and version " <= 1.4.2"		update13		Affected
Sun Search vendor "Sun"		Jre Search vendor "Sun" for product "Jre"				<= 1.5.0 Search vendor "Sun" for product "Jre" and version " <= 1.5.0"		update10		Affected
Sun Search vendor "Sun"		Sdk Search vendor "Sun" for product "Sdk"				<= 1.4.3_13 Search vendor "Sun" for product "Sdk" and version " <= 1.4.3_13"		-		Affected