PT-2015-1838 · Oracle · Oracle Glassfish Server+2

Published 2015-07-16 · Updated 2016-12-28 · CVE-2015-2623

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle GlassFish Server versions 3.0.1 through 3.1.2 Oracle WebLogic Server versions 10.3.6.0 through 12.1.3.0

Description The issue is related to errors in the code of the Oracle GlassFish Server and Oracle WebLogic Server components in Oracle Fusion Middleware. It allows remote attackers to affect the integrity of information via unknown vectors related to Java Server Faces.

Recommendations For Oracle GlassFish Server versions 3.0.1 through 3.1.2, update to a version that includes the fix for this issue. For Oracle WebLogic Server versions 10.3.6.0 through 12.1.3.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to Java Server Faces components until a patch is available.

Fix

Weakness Enumeration

CWE-17

Related Identifiers

BDU:2015-11184

CVE-2015-2623

Affected Products

Sun Java Server Faces

Oracle Glassfish Server

Oracle Weblogic Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-2623 · Security Note
• http://oracle.com/technetwork/topics/security/cpujul2015-2367936.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11184 · Security Note
• http://securitytracker.com/id/1032953 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2623 · Note
• http://oracle.com/technetwork/topics/security/cpujul2015-2367936.html#AppendixFMW · Note