PT-2017-16050 · Oracle · Oracle Glassfish Server

Published 2017-04-24 · Updated 2019-10-03 · CVE-2017-3626

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle GlassFish Server version 3.1.2

Description The issue allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle GlassFish Server, but it is difficult to exploit and requires human interaction from a person other than the attacker. Successful attacks can result in unauthorized read access to a subset of Oracle GlassFish Server accessible data.

Recommendations For Oracle GlassFish Server version 3.1.2, update to a version that contains a fix for this issue, as no specific workaround or mitigation measures are provided.

Fix

Related Identifiers

CVE-2017-3626

Affected Products

Oracle Glassfish Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2017-3626 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-3626 · Security Note
• https://ubuntu.com/security/CVE-2017-3626 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-3626 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-3626 · Vendor Advisory
• http://securitytracker.com/id/1038293 · Note
• http://securityfocus.com/bid/97896 · Note