VULNERABILITY INTELLIGENCE
CVE-2009-1106
CVSS score6.4 MEDIUM
EPSS probability3.56%
CISA KEVNot currently listed
Published2009-03-25
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:N/I:P/A:P
Description
The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 does not properly parse crossdomain.xml files, which allows remote attackers to bypass intended access restrictions and connect to arbitrary sites via unknown vectors, aka CR 6798948.
Weakness classification
- CWE-20: Improper Input Validation