{"api_version":"1","generated_at":"2026-07-23T09:13:25+00:00","cve":"CVE-2005-3398","urls":{"html":"https://cve.report/CVE-2005-3398","api":"https://cve.report/api/cve/CVE-2005-3398.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2005-3398","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2005-3398"},"summary":{"title":"CVE-2005-3398","description":"The default configuration of the web server for the Solaris Management Console (SMC) in Solaris 8, 9, and 10 enables the HTTP TRACE method, which could allow remote attackers to obtain sensitive information such as cookies and authentication data from HTTP headers.","state":"PUBLISHED","assigner":"mitre","published_at":"2005-11-01 12:47:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["CWE-200","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.vupen.com/english/advisories/2005/2226","name":"http://www.vupen.com/english/advisories/2005/2226","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/15222","name":"http://www.securityfocus.com/bid/15222","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Sun Solaris Management Console HTTP TRACE Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1445","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1445","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/17334","name":"http://secunia.com/advisories/17334","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Secunia - Advisories - Sun Solaris HTTP TRACE Response Cross-Site Scripting Issue","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1015112","name":"http://securitytracker.com/id?1015112","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"SecurityTracker.com Archives - Solaris Management Console Enables HTTP TRACE Support By Default","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102016-1","name":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102016-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"#102016: The Solaris Management Console (SMC) Enables TRACE HTTP by Default","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-3398","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-3398","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2005","cve_id":"3398","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"sun","cpe5":"solaris","cpe6":"10.0","cpe7":"*","cpe8":"sparc","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"3398","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"sun","cpe5":"solaris","cpe6":"9.0","cpe7":"*","cpe8":"sparc","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"3398","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"sun","cpe5":"sunos","cpe6":"5.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T23:10:08.638Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"15222","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/15222"},{"name":"17334","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/17334"},{"name":"102016","tags":["vendor-advisory","x_refsource_SUNALERT","x_transferred"],"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102016-1"},{"name":"oval:org.mitre.oval:def:1445","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1445"},{"name":"ADV-2005-2226","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2005/2226"},{"name":"1015112","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1015112"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2005-10-26T00:00:00.000Z","descriptions":[{"lang":"en","value":"The default configuration of the web server for the Solaris Management Console (SMC) in Solaris 8, 9, and 10 enables the HTTP TRACE method, which could allow remote attackers to obtain sensitive information such as cookies and authentication data from HTTP headers."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-10-10T00:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"15222","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/15222"},{"name":"17334","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/17334"},{"name":"102016","tags":["vendor-advisory","x_refsource_SUNALERT"],"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102016-1"},{"name":"oval:org.mitre.oval:def:1445","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1445"},{"name":"ADV-2005-2226","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2005/2226"},{"name":"1015112","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1015112"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2005-3398","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The default configuration of the web server for the Solaris Management Console (SMC) in Solaris 8, 9, and 10 enables the HTTP TRACE method, which could allow remote attackers to obtain sensitive information such as cookies and authentication data from HTTP headers."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"15222","refsource":"BID","url":"http://www.securityfocus.com/bid/15222"},{"name":"17334","refsource":"SECUNIA","url":"http://secunia.com/advisories/17334"},{"name":"102016","refsource":"SUNALERT","url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102016-1"},{"name":"oval:org.mitre.oval:def:1445","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1445"},{"name":"ADV-2005-2226","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2005/2226"},{"name":"1015112","refsource":"SECTRACK","url":"http://securitytracker.com/id?1015112"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2005-3398","datePublished":"2005-11-01T11:00:00.000Z","dateReserved":"2005-11-01T00:00:00.000Z","dateUpdated":"2024-08-07T23:10:08.638Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2005-11-01 12:47:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["CWE-200","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:sun:solaris:9.0:*:sparc:*:*:*:*:*","matchCriteriaId":"A711CDC2-412C-499D-9FA6-7F25B06267C6"},{"vulnerable":true,"criteria":"cpe:2.3:o:sun:solaris:10.0:*:sparc:*:*:*:*:*","matchCriteriaId":"7BF232A9-9E0A-481E-918D-65FC82EF36D8"},{"vulnerable":true,"criteria":"cpe:2.3:o:sun:sunos:5.8:*:*:*:*:*:*:*","matchCriteriaId":"A2475113-CFE4-41C8-A86F-F2DA6548D224"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2005","CveId":"3398","Ordinal":"1","Title":"CVE-2005-3398","CVE":"CVE-2005-3398","Year":"2005"},"notes":[{"CveYear":"2005","CveId":"3398","Ordinal":"1","NoteData":"The default configuration of the web server for the Solaris Management Console (SMC) in Solaris 8, 9, and 10 enables the HTTP TRACE method, which could allow remote attackers to obtain sensitive information such as cookies and authentication data from HTTP headers.","Type":"Description","Title":"CVE-2005-3398"},{"CveYear":"2005","CveId":"3398","Ordinal":"2","NoteData":"2005-11-01","Type":"Other","Title":"Published"},{"CveYear":"2005","CveId":"3398","Ordinal":"3","NoteData":"2017-10-09","Type":"Other","Title":"Modified"}]}}}