CVE-2009-0278: Sun Java System Application Server

Medium severity, CVSS 5.0. EPSS: 2.2% chance of exploitation in the next 30 days.

Sun Java System Application Server (AS) 8.1 and 8.2 allows remote attackers to read the Web Application configuration files in the (1) WEB-INF or (2) META-INF directory via a malformed request.

Affected products

• Sun Java System Application Server: version 8.1 only; version 8.2 only

Published 2009-01-27. Last modified 2026-06-16.