CVE-2004-1029

CVE-2004-1029 describes a critical vulnerability in the Sun Java Plugin within Java 2 Runtime Environment (JRE) versions 1.4.2_01, 1.4.2_04, and potentially earlier. This flaw allows remote attackers to bypass security restrictions between JavaScript and Java applets, enabling the loading of unsafe classes and arbitrary code execution by leveraging the reflection API to access private Java packages. The vulnerability affects various products from vendors like Sun, HP, and Symantec, among others. Rated with a CVSS score of 9.3 (Critical), this vulnerability has a high severity due to its network-based attack vector, medium attack complexity, and complete compromise of confidentiality, integrity, and availability. Its EPSS score of 0.370320000 indicates a higher-than-average exploitability probability compared to many other CVEs. While not listed on the CISA KEV catalog, exploit code for this vulnerability is publicly available, as evidenced by an ExploitDB entry. Despite the availability of exploit code, there is no indication of active exploitation in the wild, and community discussion and media coverage for this CVE are minimal.