CVE-2009-0348: sun java_system_access_manager
Vulnerability summary
CVE-2009-0348 is a medium (CVSS 5.0) vulnerability in sun java_system_access_manager. EPSS estimates a 8.16% chance of exploitation in the next 30 days, higher than 94.8% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 29-01-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The login module in Sun Java System Access Manager 6 2005Q1 (aka 6.3), 7 2005Q4 (aka 7.0), and 7.1 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
8.16%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 8.16% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundSun Java System Access Manager 7.1 - 'Username' Enumeration
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Sun1 product
- java_system_access_manager6.3_2005q1 | 7.1 | 7_2005q4
1 vendor · 1 product