PT-2023-7311 · Eclipse+1 · Eclipse Glassfish+1

Tr1Ple Kurosel · Publicado 2023-10-25 · Atualizado 2023-11-13 · CVE-2023-5763

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Eclipse Glassfish versions 5 or 6

Description The issue exists due to insufficient input validation, allowing a remote attacker to load malicious code on the server. This can be achieved via access to insecure ORB listeners when running with old versions of JDK, specifically lower than 6u211, 7u201, or 8u191.

Recommendations For Eclipse Glassfish versions 5 or 6, update the JDK to version 6u211, 7u201, or 8u191 or later to resolve the issue. As a temporary workaround, consider restricting access to insecure ORB listeners until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

CWE-913

Identificadores relacionados

BDU:2023-08340

CVE-2023-5763

GHSA-2MW4-WJ8C-7F93

Produtos afetados

Eclipse Glassfish

Jdk

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-5763 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-5763 · Aviso do Fabricante
• https://glassfish.org/docs/latest/security-guide.html#securing-glassfish-server · Nota
• https://gitlab.eclipse.org/security/cve-assignement/-/issues/14 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1720333109839667547 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1720392878143209563 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-08340 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-2mw4-wj8c-7f93 · Aviso do Fabricante