FKIE_CVE-2008-0628

Vulnerability from fkie_nvd - Published: 2008-02-06 21:00 - Updated: 2026-06-16 22:50
Severity
Summary
The XML parsing code in Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier processes external entity references even when the "external general entities" property is false, which allows remote attackers to conduct XML external entity (XXE) attacks and cause a denial of service or access restricted resources.
References
cve@mitre.orghttp://dev2dev.bea.com/pub/advisory/277
cve@mitre.orghttp://scary.beasts.org/security/CESA-2007-002.html
cve@mitre.orghttp://secunia.com/advisories/28746Patch, Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/29841
cve@mitre.orghttp://secunia.com/advisories/29858
cve@mitre.orghttp://secunia.com/advisories/30780
cve@mitre.orghttp://security.gentoo.org/glsa/glsa-200804-28.xml
cve@mitre.orghttp://securityreason.com/securityalert/3621
cve@mitre.orghttp://sunsolve.sun.com/search/document.do?assetkey=1-66-231246-1
cve@mitre.orghttp://www.gentoo.org/security/en/glsa/glsa-200804-20.xml
cve@mitre.orghttp://www.gentoo.org/security/en/glsa/glsa-200806-11.xml
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2008-0245.html
cve@mitre.orghttp://www.securityfocus.com/archive/1/487434/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/27553
cve@mitre.orghttp://www.securitytracker.com/id?1019292
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/0371
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/1252
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9847
af854a3a-2127-422b-91ae-364da2661108http://dev2dev.bea.com/pub/advisory/277
af854a3a-2127-422b-91ae-364da2661108http://scary.beasts.org/security/CESA-2007-002.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/28746Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29841
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29858
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/30780
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-200804-28.xml
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/3621
af854a3a-2127-422b-91ae-364da2661108http://sunsolve.sun.com/search/document.do?assetkey=1-66-231246-1
af854a3a-2127-422b-91ae-364da2661108http://www.gentoo.org/security/en/glsa/glsa-200804-20.xml
af854a3a-2127-422b-91ae-364da2661108http://www.gentoo.org/security/en/glsa/glsa-200806-11.xml
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2008-0245.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/487434/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/27553
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1019292
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/0371
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/1252
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9847
Impacted products
Vendor Product Version
sun jdk 1.6
sun jre *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sun:jdk:1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "8502A8C5-0219-406B-8DAA-BF35BCD6DC94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sun:jre:*:update3:*:*:*:*:*:*",
              "matchCriteriaId": "EAB2C9C2-F685-450B-9980-553966FC3B63",
              "versionEndIncluding": "1.6.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The XML parsing code in Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier processes external entity references even when the \"external general entities\" property is false, which allows remote attackers to conduct XML external entity (XXE) attacks and cause a denial of service or access restricted resources."
    },
    {
      "lang": "es",
      "value": "El c\u00f3digo de an\u00e1lisis sint\u00e1ctico de XML en Sun Java Runtime Environment JDK y JRE 6 actualizaci\u00f3n 3 y anteriores. Procesa  referencias a entidades externas incluso cuando la propiedad \"external general entities (entidades generales externas)\" es falsa, lo que permite a atacantes remotos llevar a cabo ataques de entidades externas XML (XXE) y provocar una denegaci\u00f3n de servicio o acceso restringido a recursos."
    }
  ],
  "id": "CVE-2008-0628",
  "lastModified": "2026-06-16T22:50:01.303",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.8,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 7.8,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2008-02-06T21:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://dev2dev.bea.com/pub/advisory/277"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://scary.beasts.org/security/CESA-2007-002.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/28746"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/29841"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/29858"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/30780"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://security.gentoo.org/glsa/glsa-200804-28.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/3621"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-231246-1"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200804-20.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200806-11.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0245.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/487434/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/27553"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1019292"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/0371"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/1252"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9847"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://dev2dev.bea.com/pub/advisory/277"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://scary.beasts.org/security/CESA-2007-002.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/28746"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/29841"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/29858"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/30780"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-200804-28.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/3621"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-231246-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200804-20.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200806-11.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0245.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/487434/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/27553"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1019292"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/0371"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/1252"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9847"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.