PT-2018-12439 · Oracle · Oracle Glassfish Open Source Edition

Glassfishrobot · Published 2018-07-16 · Updated 2019-05-20 · CVE-2018-14324

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle GlassFish Open Source Edition version 5.0

Description The issue allows remote attackers to obtain potentially sensitive information, perform database operations, or manipulate the demo via a JMX RMI session. This is due to the demo feature having TCP port 7676 open by default with a password of admin for the admin account.

Recommendations For Oracle GlassFish Open Source Edition version 5.0, change the default password of the admin account to prevent unauthorized access. Consider restricting access to TCP port 7676 to minimize the risk of exploitation. As a temporary workaround, consider disabling the demo feature until a more secure configuration can be implemented.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2018-14324

Affected Products

Oracle Glassfish Open Source Edition

References · 8

• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14324 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-14324 · Security Note
• https://ubuntu.com/security/CVE-2018-14324 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14324 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14324 · Vendor Advisory
• https://github.com/javaee/glassfish/issues/22500 · Note
• https://github.com/eclipse-ee4j/glassfish/issues/22500 · Note
• http://securitytracker.com/id/1041292 · Note