CVE-2009-1934 [Medium] | XSS in Java System Web Server

CVE-2009-1934 is rated Moderate Risk (46.9/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 2.23%). EPSS rose +1.56% over the last day, indicating growing attacker interest. Review affected assets and schedule remediation.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.68%	2.23%	+1.56%
2	2026-02-18	0.60%	0.68%	+0.07%
3	2025-03-17	—	0.60%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.68%

2.23%

+1.56%

2026-02-18

0.60%

0.68%

+0.07%

2025-03-17

—

0.60%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
4.3	2.0	MEDIUM	`AV:N/AC:M/Au:N/C:N/I:P/A:N` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:M) Exploitation needs some favorable conditions, but not exceptional ones. Authentication (AU:N) No authentication is required. Confidentiality impact (C:N) No confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:N) No availability impact.	8.6	2.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

4.3

2.0

MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:M): Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:N): No confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:N): No availability impact.

8.6

2.9

[email protected]

Affected software / configurations for CVE-2009-1934

Vendor	Product	Version	Raw CPE
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp10:aix:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp4:aix:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp5:aix:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp6:aix:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp7:aix:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp8:aix:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp9:aix:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1::aix:::::
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp1:aix:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp2:aix:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp3:aix:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp10:hp_ux:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp4:hp_ux:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp5:hp_ux:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp6:hp_ux:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp7:hp_ux:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp8:hp_ux:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp9:hp_ux:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1::hp_ux:::::
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp1:hp_ux:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp2:hp_ux:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp3:hp_ux:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp10:linux:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp4:linux:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp5:linux:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp6:linux:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp7:linux:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp8:linux:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp9:linux:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1::linux:::::
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp1:linux:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp2:linux:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp3:linux:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp10:windows:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp4:windows:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp5:windows:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp6:windows:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp7:windows:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp8:windows:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp9:windows:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1::windows:::::
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp1:windows:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp2:windows:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp3:windows:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp10:sparc:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp4:sparc:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp5:sparc:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp6:sparc:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp7:sparc:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp8:sparc:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp9:sparc:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1::sparc:::::
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp1:sparc:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp2:sparc:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp3:sparc:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp10:x86:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp4:x86:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp48:x86:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp5:x86:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp6:x86:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp7:x86:::::*
sun	java_system_web_server	6.1	cpe:2.3:a:sun:java_system_web_server:6.1:sp9:x86:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1::x86:::::
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp1:x86:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp2:x86:::::*
sun	one_web_server	6.1	cpe:2.3:a:sun:one_web_server:6.1:sp3:x86:::::*

References for CVE-2009-1934

URL	Tags
http://osvdb.org/54872
http://secunia.com/advisories/35338	Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-21-116648-23-1	Patch
http://sunsolve.sun.com/search/document.do?assetkey=1-66-259588-1	Patch Vendor Advisory
http://support.avaya.com/elmodocs2/security/ASA-2009-211.htm
http://www.securityfocus.com/bid/35204
http://www.securitytracker.com/id?1022334
http://www.vupen.com/english/advisories/2009/1500
https://exchange.xforce.ibmcloud.com/vulnerabilities/50951

URL

CVE-2009-1934

Exploit prediction scoring system (EPSS) score for CVE-2009-1934

Common vulnerability scoring system (CVSS) metrics for CVE-2009-1934

Weakness enumeration for CVE-2009-1934

Affected software / configurations for CVE-2009-1934

References for CVE-2009-1934