CVE-2017-1000030
CriticalSummary
GlassFish Server version 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure, allowing an unauthenticated attacker to obtain the administrative user's plain text password and gain access to the web-based administration interface.
Risk Assessment
The disclosure of the administrative password poses a serious security risk, enabling attackers to gain full access to the server management system.
Recommendation
It is recommended to upgrade to the latest version of GlassFish Server and implement additional security measures such as stronger authentication mechanisms.
Original NVD description (English source)
Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure vulnerability, that makes it possible to provide an unauthenticated attacker plain text password of administrative user and grant access to the web-based administration interface.