CVE-2017-10391
HighSummary
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise the server. Successful attacks can lead to unauthorized access to data and cause a partial denial of service.
Risk Assessment
The organization is at risk of unauthorized modifications, deletions, or reads of data, which can lead to loss of integrity and confidentiality. Additionally, there is a risk of partial denial of service, which may affect system availability.
Recommendation
It is recommended to update to the latest version of Oracle GlassFish Server to mitigate the risk associated with this vulnerability. Appropriate network security measures should also be implemented to restrict access to the server.
Other vulnerabilities in Oracle GlassFish Server
See all- CVE-2017-3250High
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise the server. Successful attacks can lead to unauthorized access to data and cause a partial denial of service.
- CVE-2017-3249High
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via LDAP to compromise the server. Successful attacks can lead to unauthorized access to data and partial denial of service.
- CVE-2016-5519High
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to Java Server Faces.
- CVE-2015-0396High
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Admin Console.
- CVE-2016-5528Critical
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access to compromise the server. Attacks may significantly impact additional products, potentially resulting in takeover of the Oracle GlassFish Server.
- CVE-2016-3607Critical
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Web Container.
Original NVD description (English source)
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Oracle GlassFish Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).