CVE-2009-1104
CWE-16Published: March 25, 2009· Updated: Jun 16, 2026
Official Description
The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; and 1.4.2_19 and earlier does not prevent Javascript that is loaded from the localhost from connecting to other ports on the system, which allows user-assisted attackers to bypass intended access restrictions via LiveConnect, aka CR 6724331. NOTE: this vulnerability can be leveraged with separate cross-site scripting (XSS) vulnerabilities for remote attack vectors.
Technical Analysis
CVE-2009-1104 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
All References (60)
Quick Facts
Related CVEs (CWE-16)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2009-1104 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts