PT-2018-12439 · Oracle · Oracle Glassfish Open Source Edition

Glassfishrobot · Publicado 2018-07-16 · Atualizado 2019-05-20 · CVE-2018-14324

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle GlassFish Open Source Edition version 5.0

Description The issue allows remote attackers to obtain potentially sensitive information, perform database operations, or manipulate the demo via a JMX RMI session. This is due to the demo feature having TCP port 7676 open by default with a password of admin for the admin account.

Recommendations For Oracle GlassFish Open Source Edition version 5.0, change the default password of the admin account to prevent unauthorized access. Consider restricting access to TCP port 7676 to minimize the risk of exploitation. As a temporary workaround, consider disabling the demo feature until a more secure configuration can be implemented.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2018-14324

Produtos afetados

Oracle Glassfish Open Source Edition

Referências · 8

• https://github.com/javaee/glassfish/issues/22500 · Nota
• https://github.com/eclipse-ee4j/glassfish/issues/22500 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14324 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-14324 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-14324 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-14324 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-14324 · Aviso do Fabricante
• http://securitytracker.com/id/1041292 · Nota