Login Request a demo
Unscored severity · published Dec 30, 2011
CVE-2011-5035
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values…
–
CVSS
68.2%
EPSS
No
On KEV
Description
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.
Exploitation
Is it being used?
Exploit prediction (EPSS)68.2% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GS
Glassfish Server · Oracle
through 3.1.1; 2.1.1; 3.0.1 · source: NVD
Affected product
GS
Glassfish Server
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-5035
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-5035
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00010.html
marc.info
http://marc.info/?l=bugtraq&m=133364885411663&w=2
marc.info
http://marc.info/?l=bugtraq&m=133847939902305&w=2
marc.info
http://marc.info/?l=bugtraq&m=134254866602253&w=2
marc.info
http://marc.info/?l=bugtraq&m=134254957702612&w=2
More from Glassfish Server
9.8
CVE-2018-14324
The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account
9.8
CVE-2017-1000030
Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure vulnerability, that makes it possible to provide an…
9.8
CVE-2016-3607
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality, integrity, and…
9.8
CVE-2015-7182
Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR…
9.0
CVE-2016-5528
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security)