CVE-2004-2763: Sun Iplanet Web Server

Medium severity, CVSS 5.8. EPSS: 2.2% chance of exploitation in the next 30 days.

The default configuration of Sun ONE/iPlanet Web Server 4.1 SP1 through SP12 and 6.0 SP1 through SP5 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.

Affected products

• Sun Iplanet Web Server: version 4.1 only; version 6.0 only
• Sun One Web Server: version 4.1 only; version 6.0 only; version 6.1 only

Published 2009-06-01. Last modified 2026-06-16.