CVE-2007-3504
Directory traversal vulnerability in the PersistenceService in Sun Java Web Start in JDK and JRE...
Directory traversal vulnerability in the PersistenceService in Sun Java Web Start in JDK and JRE 5.0 Update 11 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, for Windows allows remote attackers to perform unauthorized actions via an application that grants file overwrite privileges to itself. NOTE: this can be leveraged to execute arbitrary code by overwriting a .java.policy file.
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in the PersistenceService in Sun Java Web Start in JDK and JRE 5.0 Update 11 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, for Windows allows remote attackers to perform unauthorized actions via an application that grants file overwrite privileges to itself. NOTE: this can be leveraged to execute arbitrary code by overwriting a .java.policy file.
- Record
CVE-2007-3504- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in the PersistenceService in Sun Java Web Start in JDK and JRE 5.0 Update 11 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, for Windows allows remote attackers to perform unauthorized actions via an application that grants file overwrite privileges to itself. NOTE: this can be leveraged to execute arbitrary code by overwriting a .java.policy file.
- Record
CVE-2007-3504- Updated
- 2026-11-02
EUVDEUVD-2007-3488 No score
Directory traversal vulnerability in the PersistenceService in Sun Java Web Start in JDK and JRE 5.0 Update 11 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, for Windows allows remote attackers to perform unauthorized actions via an application that grants file overwrite privileges to itself. NOTE: this can be leveraged to execute arbitrary code by overwriting a .java.policy file.
- Record
EUVD-2007-3488- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vp9h-w4rm-xp28 No score
Directory traversal vulnerability in the PersistenceService in Sun Java Web Start in JDK and JRE...
Directory traversal vulnerability in the PersistenceService in Sun Java Web Start in JDK and JRE 5.0 Update 11 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, for Windows allows remote attackers to perform unauthorized actions via an application that grants file overwrite privileges to itself. NOTE: this can be leveraged to execute arbitrary code by overwriting a .java.policy file.
- Record
GHSA-vp9h-w4rm-xp28- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases, references, title | GitHub Advisories | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3504 is a high vulnerability (CVSS 9.3) in Sun Jdk, published June 30, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.42%, the 93rd percentile. No source names a fixed version.
References
vupen.com/english/advisories/2007/2384
docs.info.apple.com/article.html?artnum=307177
securitytracker.com/id?1018328
osvdb.org/37755
exchange.xforce.ibmcloud.com/vulnerabilities/35169
lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html
Show 8 moreShow less
secunia.com/advisories/25823
sunsolve.sun.com/search/document.do?assetkey=1-26-102957-1
securityfocus.com/archive/1/472673/100/0/threaded
nvd.nist.gov/vuln/detail/CVE-2007-3504
github.com/advisories/GHSA-vp9h-w4rm-xp28