CVE-2010-0386

Published: Jan 25, 2010Modified: May 28, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The default configuration of Sun Java System Application Server 7 and 7 2004Q2 enables the HTTP TRACE method, which makes it easier for remote attackers to steal cookies and authentication credentials via a cross-site tracing (XST) attack, a related issue to CVE-2004-2763 and CVE-2005-3398.

Affected (3)

Products: Sun: Java System Application Server

1 product

Java System Application Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Sun Java System Application Server	Version 7.0
Sun Java System Application Server	Version 7.0
Sun Java System Application Server	Version 7.0

Related CWEs

Improper Neutralization of Leading Special Elements

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes leading special elements that could be interpreted in unexpected ways when they are sent to a downstream component.

References (2)

http://sunsolve.sun.com/search/document.do?assetkey=1-66-200942-1

Source: cve@mitre.org

Vendor Advisory

http://sunsolve.sun.com/search/document.do?assetkey=1-66-200942-1

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.