The default configuration of the web server for the Solaris Management Console (SMC) in Solaris 8, 9, and 10 enables the HTTP TRACE method,…

Published 21 y ago 2005-11-01 · modified 4 mo ago 2026-06-16 · JSON

CVSS

4.3

v2.0 · NVD

CISA KEV

not known exploited

EPSS

13.1%

percentile 96%

Public exploits

Metasploit

The default configuration of the web server for the Solaris Management Console (SMC) in Solaris 8, 9, and 10 enables the HTTP TRACE method, which could allow remote attackers to obtain sensitive information such as cookies and authentication data from HTTP headers.

Exploit prediction (EPSS)

13.11% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.

Exploits and detections

Metasploit auxiliary/scanner/http/trace HTTP Cross-Site Tracing Detection · metasploit auxiliary, normal rank
Metasploit auxiliary/scanner/http/options HTTP Options Detection · metasploit auxiliary, normal rank

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:P/I:N/A:N`

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

securityfocus.com /bid/15222 · vdb-entry, x_refsource_BID, x_transferred
secunia.com /advisories/17334 · third-party-advisory, x_refsource_SECUNIA, x_transferred
sunsolve.sun.com /search/document.do?assetkey=1-26-102016-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1445 · vdb-entry, signature, x_refsource_OVAL, x_transferred
vupen.com /english/advisories/2005/2226 · vdb-entry, x_refsource_VUPEN, x_transferred
securitytracker.com /id?1015112 · vdb-entry, x_refsource_SECTRACK, x_transferred

Sources

CVE List: CVE-2005-3398
NVD: CVE-2005-3398

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.