PT-2015-1838 · Oracle · Oracle Glassfish Server+2

Publicado 2015-07-16 · Atualizado 2016-12-28 · CVE-2015-2623

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle GlassFish Server versions 3.0.1 through 3.1.2 Oracle WebLogic Server versions 10.3.6.0 through 12.1.3.0

Description The issue is related to errors in the code of the Oracle GlassFish Server and Oracle WebLogic Server components in Oracle Fusion Middleware. It allows remote attackers to affect the integrity of information via unknown vectors related to Java Server Faces.

Recommendations For Oracle GlassFish Server versions 3.0.1 through 3.1.2, update to a version that includes the fix for this issue. For Oracle WebLogic Server versions 10.3.6.0 through 12.1.3.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to Java Server Faces components until a patch is available.

Correção

Enumeração de Fraquezas

CWE-17

Identificadores relacionados

BDU:2015-11184

CVE-2015-2623

Produtos afetados

Sun Java Server Faces

Oracle Glassfish Server

Oracle Weblogic Server

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-2623 · Nota de Segurança
• http://oracle.com/technetwork/topics/security/cpujul2015-2367936.html · Aviso do Fabricante
• http://securitytracker.com/id/1032953 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2623 · Nota
• http://oracle.com/technetwork/topics/security/cpujul2015-2367936.html#AppendixFMW · Nota
• https://bdu.fstec.ru/vul/2015-11184 · Nota de Segurança