Detections
Analytics
Sun Java System Access Manager 7.1 < Patch 2 Multiple Vulnerabilities
medium Nessus Network Monitor Plugin ID 5132
Synopsis
The remote host is vulnerable to multiple attack vectors.Description
The remote host is running a version of Sun Java System Access Manager 7.1 earlier than Patch 2. Such versions are potentially affected by multiple issues :- A vulnerability may allow unauthorized access to resources by revealing passwords to remote users who have privileges to access the administration console. (1-66-242166-1)
- A sub-realm administrator may be able to escalate their privileges and access the root realm as an administrator. (1-66-249106-1)
- A username-enumeration weakness could allow an attacker to determine valid user-names. (1-66-242026-1)
Solution
Upgrade to Sun Java System Access Manager 7.1 Patch 2. This may require different patches depending on your installation type.See Also
http://www.nessus.org/u?01ee02e7
http://sunsolve.sun.com/search/document.do?assetkey=1-66-242026-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-242166-1
Plugin Details
Severity: Medium
ID: 5132
Family: Web Servers
Published: 8/13/2009
Updated: 3/6/2019
Nessus ID: 35618
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.4
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS v3
Risk Factor: Medium
Base Score: 6.3
Temporal Score: 5.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:sun:java_system_access_manager
Patch Publication Date: 1/12/2009
Vulnerability Publication Date: 1/12/2009