Login Request a demo
Low severity · published Jan 27, 2017
CVE-2017-3239
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration)
3.3
CVSS
0.4%
EPSS
No
On KEV
Description
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GlassFish Server executes to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GlassFish Server accessible data. CVSS v3.0 Base Score 3.3 (Confidentiality impacts).
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GS
Glassfish Server · Oracle
3.0.1; 3.1.2 · source: NVD
Affected product
GS
Glassfish Server
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-3239
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-3239
Patch
http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html
www.securityfocus.com
http://www.securityfocus.com/bid/95493
More from Glassfish Server
9.8
CVE-2018-14324
The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account
9.8
CVE-2017-1000030
Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure vulnerability, that makes it possible to provide an…
9.8
CVE-2016-3607
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality, integrity, and…
9.8
CVE-2015-7182
Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR…
9.0
CVE-2016-5528
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security)