Juddi
Vendor:
First CVE: May 19, 2017 · Active for 9 years
6
Total CVEs
More Total CVEs than 80% of tracked products
2.0
Avg CVEs / Year
Higher CVE frequency than 60% of tracked products
7.0
Avg CVSS
Higher Avg CVSS than 41% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Juddi over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 19, 2017
9 years ago
Most Recent CVE
Jul 29, 2021
1,821 days ago
CVE Severity & Scoring
Juddi6 CVEs
67%
17%
17%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network6 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low5 (83.3%)
High1 (16.7%)
Unknown0 (0.0%)
User Interaction
None4 (66.7%)
Unknown0 (0.0%)
Required2 (33.3%)
Privileges Required
Low1 (16.7%)
High0 (0.0%)
None5 (83.3%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-37578CRITICAL Apache jUDDI uses several classes related to Java's Remote Method Invocation (RMI) which (as an extension to UDDI) provides an alternate transport for accessing UDDI services. RMI | Jul 29, 2021 | 9.8 | 31 | NO | NO |
CVE-2018-1307HIGH In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data stru | Feb 9, 2018 | 8.1 | 26 | NO | NO |
CVE-2009-4267MEDIUM The console in Apache jUDDI 3.0.0 does not properly escape line feeds, which allows remote authenticated users to spoof log entries via the numRows parameter. | Feb 19, 2018 | 6.5 | 22 | NO | NO |
CVE-2009-1198MEDIUM Cross-site scripting (XSS) vulnerability in Apache jUDDI before 2.0 allows remote attackers to inject arbitrary web script or HTML via the dsname parameter to happyjuddi.jsp. | Oct 30, 2017 | 6.1 | 22 | NO | NO |
CVE-2009-1197MEDIUM Apache jUDDI before 2.0 allows attackers to spoof entries in log files via vectors related to error logging of keys from uddiget.jsp. | Oct 30, 2017 | 5.3 | 22 | NO | NO |
CVE-2015-5241MEDIUM After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible for malicious users to redirect the browser to an unintended w | May 19, 2017 | 6.1 | 17 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (6 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (6 CVEs).
Media Mentions
Signals from CVEs in this product scope (6 CVEs).
Top CNAs Publishing CVEs For Juddi
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 3.1.5 | 1 | 6.1 | 2.3% | 0 | 0 |
| 3.1.4 | 1 | 6.1 | 2.3% | 0 | 0 |
| 3.1.3 | 1 | 6.1 | 2.3% | 0 | 0 |
| 3.1.2 | 1 | 6.1 | 2.3% | 0 | 0 |
| 3.0.0 | 1 | 6.5 | 1.5% | 0 | 0 |
| 2.0 | 1 | 5.3 | 3.6% | 0 | 0 |
| 0.9 | 1 | 5.3 | 3.6% | 0 | 0 |