CVE-2004-2763

Severity: medium (CVSS 5.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-06-01 · updated 2026-06-16
Weakness: CWE-16

Description

The default configuration of Sun ONE/iPlanet Web Server 4.1 SP1 through SP12 and 6.0 SP1 through SP5 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.

Affected products

Sun Iplanet Web Server: 4.1-sp1, 4.1-sp10, 4.1-sp11, 4.1-sp12, 4.1-sp2, 4.1-sp3 (+11)
Sun One Web Server: 4.1, 4.1-sp1, 4.1-sp10, 4.1-sp11, 4.1-sp12, 4.1-sp2 (+12)

References

http://archive.cert.uni-stuttgart.de/uniras/2004/02/msg00007.html
http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf
http://www.kb.cert.org/vuls/id/867593
http://archive.cert.uni-stuttgart.de/uniras/2004/02/msg00007.html
http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf
http://www.kb.cert.org/vuls/id/867593

Get alerted when CVE-2004-2763 or the next vulnerability affects your stack