CVE-2003-0413
CVE-2003-0413 is a medium-severity vulnerability in Sun One Application Server with a CVSS 2.0 base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 2.0 base score 6.8)
- EPSS exploit prediction: 7% (93rd percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Sun One Application Server
- Published:
- Last modified:
Description
Cross-site scripting (XSS) vulnerability in the webapps-simple sample application for (1) Sun ONE Application Server 7.0 for Windows 2000/XP or (2) Sun Java System Web Server 6.1 allows remote attackers to insert arbitrary web script or HTML via an HTTP request that generates an "Invalid JSP file" error, which inserts the text in the resulting error message.
Frequently asked questions
- What is CVE-2003-0413?
- Cross-site scripting (XSS) vulnerability in the webapps-simple sample application for (1) Sun ONE Application Server 7.0 for Windows 2000/XP or (2) Sun Java System Web Server 6.1 allows remote attackers to insert arbitrary web script or HTML via an HTTP request that generates an "Invalid JSP file" error, which inserts the text in the resulting error message.
- How severe is CVE-2003-0413?
- CVE-2003-0413 has a CVSS 2.0 base score of 6.8, rated medium severity.
- Is CVE-2003-0413 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 7% (93rd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2003-0413?
- CVE-2003-0413 affects Sun One Application Server. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2003-0413?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2003-0413 published?
- CVE-2003-0413 was published on 2003-06-30 and last updated on 2026-06-16.
References
- http://marc.info/?l=bugtraq&m=105409846029475&w=2
- http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F55221&zone_32=category%3Asecurity
- http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57605
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-201009-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1000610.1-1
- http://www.ciac.org/ciac/bulletins/n-103.shtml
- http://www.iss.net/security_center/static/12095.php
- http://www.securityfocus.com/bid/7710
- http://www.spidynamics.com/sunone_alert.html
Affected products (1)
- cpe:2.3:a:sun:one_application_server:7.0:*:*:*:*:*:*:*
More vulnerabilities in Sun One Application Server
- CVE-2004-0826 — High (CVSS 7.5): Heap-based buffer overflow in Netscape Network Security Services (NSS) library allows remote attackers to execute…
- CVE-2002-0387 — High (CVSS 7.5): Buffer overflow in gxnsapi6.dll NSAPI plugin of the Connector Module for Sun ONE Application Server before 6.5 allows…
- CVE-2003-0414 — High (CVSS 7.2): The installation of Sun ONE Application Server 7.0 for Windows 2000/XP creates a statefile with world-readable…
- CVE-2006-6276 — Medium (CVSS 6.8): HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System…
- CVE-2006-2501 — Medium (CVSS 6.8): Cross-site scripting (XSS) vulnerability in Sun ONE Web Server 6.0 SP9 and earlier, Java System Web Server 6.1 SP4 and…
- CVE-2004-1815 — Medium (CVSS 5.0): Unknown vulnerability in ColdFusion MX 6.0 and 6.1, and JRun 4.0, when a SOAP web service expects an array of objects…