← Vulnerability feed

Vulnerability record · CVE-2009-2717 · published 10 August 2009

CVE-2009-2717: Sun java se permissions and access controls vulnerability

Sun · Java Se

The Abstract Window Toolkit (AWT) implementation in Sun Java SE 6 before Update 15 on Windows 2000 Professional does not provide a Security Warning Icon, which makes it easier for context-dependent attackers to trick a user into interacting unsafely with an untrusted applet.

6.8 CVSS 2.0 Medium EPSS 1.3% · top 30.1% CWE-264 · Permissions and access controls
6.8CVSS 2.0 base score
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
16 Jun 2026Last modified by NVD

Description

The Abstract Window Toolkit (AWT) implementation in Sun Java SE 6 before Update 15 on Windows 2000 Professional does not provide a Security Warning Icon, which makes it easier for context-dependent attackers to trick a user into interacting unsafely with an untrusted applet.

AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://java.sun.com/javase/6/webnotes/6u15.html Vendor Advisory
http://java.sun.com/javase/6/webnotes/6u15.html Vendor Advisory

Track CVE-2009-2717 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2009-2721Sun java se vulnerabilityMultiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6406…EPSS 2.4%10.0CVE-2009-2722Sun java se vulnerabilityMultiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6429…EPSS 2.8%10.0CVE-2009-2723Sun java se vulnerabilityUnspecified vulnerability in deserialization in the Provider class in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, aka Bug…EPSS 2.7%10.0CVE-2009-2476Sun java se permissions and access controls vulnerabilityThe Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which …EPSS 2.9%10.0CVE-2009-2689Sun java se permissions and access controls vulnerabilityJDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecifie…EPSS 2.8%9.3CVE-2009-2724Sun java se race condition vulnerabilityRace condition in the java.lang package in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, related to a "3Y Race condition in…EPSS 1.6%7.8CVE-2009-2475Sun java se information exposure vulnerabilitySun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vec…EPSS 2.3%7.5CVE-2009-2716Sun java se vulnerabilityThe plugin functionality in Sun Java SE 6 before Update 15 does not properly implement version selection, which allows context-dependent attackers to…EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2009-2717), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.