Vulnerability record · CVE-2009-2705 · published 11 August 2009

CVE-2009-2705: Sun j2ee permissions and access controls vulnerability

Sun · J2ee

CA SiteMinder allows remote attackers to bypass cross-site scripting (XSS) protections for J2EE applications via a request containing non-canonical, "overlong Unicode" in place of blacklisted characters.

4.3 CVSS 2.0 Medium EPSS 4.4% · top 9.1% CWE-264 · Permissions and access controls

4.3CVSS 2.0 base score

4.4%EPSS exploitation probability, 30 days

NoNot in CISA KEV

2Affected product versions listed by NVD

2References

16 Jun 2026Last modified by NVD

Description

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Siteminder Broadcom

J2ee Sun

References

Link	Tags
http://i8jesus.com/?p=55	URL Repurposed
http://i8jesus.com/?p=55	URL Repurposed

Track CVE-2009-2705 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2003-1573Sun j2ee sql injection vulnerabilityThe PointBase 4.6 database component in the J2EE 1.4 reference implementation (J2EE/RI) allows remote attackers to execute arbitrary programs, conduc…EPSS 5.0%1 Jun 2009 4.3CVE-2013-5968Ca web agents cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in CA SiteMinder 12.0 through 12.51, and SiteMinder 6 Web Agents, allows remote attackers to inject arbitrar…EPSS 2.6%29 Oct 2013 4.3CVE-2011-1718Broadcom siteminder improper input validation vulnerabilityThe Web Agents component in CA SiteMinder R6 before SP6 CR2 and R12 before SP3 CR2 does not properly handle multi-line headers, which allows remote a…EPSS 2.4%27 Apr 2011 4.3CVE-2009-2704Sun j2ee permissions and access controls vulnerabilityCA SiteMinder allows remote attackers to bypass cross-site scripting (XSS) protections for J2EE applications via a request containing a %00 (encoded …EPSS 3.9%11 Aug 2009 5.1CVE-2015-3246libuser userhelper direct /etc/passwd write race conditionlibuser before 0.56.13-8 and 0.60 before 0.60-7, as used by the userhelper program in the usermode package, modifies /etc/passwd directly instead of …KEVEPSS 8.8%analysed11 Aug 2015 6.6CVE-2015-1769Windows Mount Manager symlink mishandling allows local privilege escalationThe Windows Mount Manager mishandles symbolic links, allowing a crafted USB device to trigger arbitrary code execution. Because the flaw is in a core…KEVEPSS 4.1%analysed15 Aug 2015 7.8CVE-2016-3643SolarWinds Virtualization Manager sudo misconfiguration privilege escalationSolarWinds Virtualization Manager 6.3.1 and earlier ship with a misconfigured sudo policy that lets a local user run privileged commands, as shown by…KEVEPSS 3.7%analysed17 Jun 2016

Source: NIST National Vulnerability Database (record CVE-2009-2705), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.