The login module in Sun Java System Access Manager 6 2005Q1 (aka 6.3), 7 2005Q4 (aka 7.0), and 7.1 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Conclusion & alert: CVE-2009-0348 is rated High Exploit Risk (67.4/100): CVSS Medium severity, with high exploitation likelihood (EPSS 10.40%, 93th percentile). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| 32762 | exploit_db | edb | 2009-01-27 | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-03-21 | 10.65% | 10.40% | -0.25% |
| 2 | 2026-01-29 | 8.47% | 10.65% | +2.19% |
| 3 | 2025-03-30 | — | 8.47% | — |
Full EPSS history (10 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 5.0 | 2.0 | MEDIUM |
|
10.0 | 2.9 | [email protected] |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| sun | java_system_access_manager | 6.3_2005q1 | cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_10_linux:*:*:*:*:* |
| sun | java_system_access_manager | 6.3_2005q1 | cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_10_sparc:*:*:*:*:* |
| sun | java_system_access_manager | 6.3_2005q1 | cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_10_windows:*:*:*:*:* |
| sun | java_system_access_manager | 6.3_2005q1 | cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_10_x86:*:*:*:*:* |
| sun | java_system_access_manager | 6.3_2005q1 | cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_8_linux:*:*:*:*:* |
| sun | java_system_access_manager | 6.3_2005q1 | cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_8_sparc:*:*:*:*:* |
| sun | java_system_access_manager | 6.3_2005q1 | cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_8_windows:*:*:*:*:* |
| sun | java_system_access_manager | 6.3_2005q1 | cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_8_x86:*:*:*:*:* |
| sun | java_system_access_manager | 6.3_2005q1 | cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_9_linux:*:*:*:*:* |
| sun | java_system_access_manager | 6.3_2005q1 | cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_9_sparc:*:*:*:*:* |
| sun | java_system_access_manager | 6.3_2005q1 | cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_9_windows:*:*:*:*:* |
| sun | java_system_access_manager | 6.3_2005q1 | cpe:2.3:a:sun:java_system_access_manager:6.3_2005q1:*:solaris_9_x86:*:*:*:*:* |
| sun | java_system_access_manager | 7.1 | cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_10_linux:*:*:*:*:* |
| sun | java_system_access_manager | 7.1 | cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_10_sparc:*:*:*:*:* |
| sun | java_system_access_manager | 7.1 | cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_10_windows:*:*:*:*:* |
| sun | java_system_access_manager | 7.1 | cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_10_x86:*:*:*:*:* |
| sun | java_system_access_manager | 7.1 | cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_8_linux:*:*:*:*:* |
| sun | java_system_access_manager | 7.1 | cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_8_sparc:*:*:*:*:* |
| sun | java_system_access_manager | 7.1 | cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_8_windows:*:*:*:*:* |
| sun | java_system_access_manager | 7.1 | cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_8_x86:*:*:*:*:* |
| sun | java_system_access_manager | 7.1 | cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_9_linux:*:*:*:*:* |
| sun | java_system_access_manager | 7.1 | cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_9_sparc:*:*:*:*:* |
| sun | java_system_access_manager | 7.1 | cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_9_windows:*:*:*:*:* |
| sun | java_system_access_manager | 7.1 | cpe:2.3:a:sun:java_system_access_manager:7.1:*:solaris_9_x86:*:*:*:*:* |
| sun | java_system_access_manager | 7_2005q4 | cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_10_linux:*:*:*:*:* |
| sun | java_system_access_manager | 7_2005q4 | cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_10_sparc:*:*:*:*:* |
| sun | java_system_access_manager | 7_2005q4 | cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_10_windows:*:*:*:*:* |
| sun | java_system_access_manager | 7_2005q4 | cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_10_x86:*:*:*:*:* |
| sun | java_system_access_manager | 7_2005q4 | cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_8_linux:*:*:*:*:* |
| sun | java_system_access_manager | 7_2005q4 | cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_8_sparc:*:*:*:*:* |
| sun | java_system_access_manager | 7_2005q4 | cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_8_windows:*:*:*:*:* |
| sun | java_system_access_manager | 7_2005q4 | cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_8_x86:*:*:*:*:* |
| sun | java_system_access_manager | 7_2005q4 | cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_9_linux:*:*:*:*:* |
| sun | java_system_access_manager | 7_2005q4 | cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_9_sparc:*:*:*:*:* |
| sun | java_system_access_manager | 7_2005q4 | cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_9_windows:*:*:*:*:* |
| sun | java_system_access_manager | 7_2005q4 | cpe:2.3:a:sun:java_system_access_manager:7_2005q4:*:solaris_9_x86:*:*:*:*:* |