Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2010-3573 — JDK vulnerability

CWE-3998 documents8 sources

Severity

5.1MEDIUMNVD

EPSS

8.0%

top 7.91%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

SUN JDK SUN JRE

Timeline

PublishedOct 19

Latest updateMay 14

Description

Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows …

CVSS vector

AV:N/AC:H/C:P/I:P/A:PExploitability: 4.9 | Impact: 6.4

Affected Packages2 packages

▶NVDsun/jdk1.6.0+3

▶NVDsun/jre1.6.0+3

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

GHSA

GHSA-hv45-8vp2-m2c8: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5↗2022-05-14

▶

CVEList

CVE-2010-3573: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5↗2010-10-19

▶

💥Exploits & PoCs

Exploit-DB

Oracle JRE - java.net.URLConnection class Same-of-Origin 'SOP' Policy Bypass↗2010-10-20

▶

📋Vendor Advisories

Ubuntu

OpenJDK vulnerabilities↗2010-10-28

▶

Red Hat

OpenJDK HttpURLConnection allows arbitrary request headers (6961084,6980004)↗2010-10-12

▶

Cisco

MIT Kerberos GSS-API Library Remote Denial of Service Vulnerability↗2010-05-19

▶

💬Community

Bugzilla

CVE-2010-3541 CVE-2010-3573 OpenJDK HttpURLConnection allows arbitrary request headers (6961084,6980004)↗2010-10-12

▶