PT-2023-7311 · Eclipse+1 · Eclipse Glassfish+1

Tr1Ple Kurosel · Published 2023-10-25 · Updated 2023-11-13 · CVE-2023-5763

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Eclipse Glassfish versions 5 or 6

Description The issue exists due to insufficient input validation, allowing a remote attacker to load malicious code on the server. This can be achieved via access to insecure ORB listeners when running with old versions of JDK, specifically lower than 6u211, 7u201, or 8u191.

Recommendations For Eclipse Glassfish versions 5 or 6, update the JDK to version 6u211, 7u201, or 8u191 or later to resolve the issue. As a temporary workaround, consider restricting access to insecure ORB listeners until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

CWE-913

Related Identifiers

BDU:2023-08340

CVE-2023-5763

GHSA-2MW4-WJ8C-7F93

Affected Products

Eclipse Glassfish

Jdk

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-5763 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5763 · Vendor Advisory
• https://gitlab.eclipse.org/security/cve-assignement/-/issues/14 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08340 · Security Note
• https://osv.dev/vulnerability/GHSA-2mw4-wj8c-7f93 · Vendor Advisory
• https://glassfish.org/docs/latest/security-guide.html#securing-glassfish-server · Note
• https://twitter.com/CVEnew/status/1720333109839667547 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1720392878143209563 · Twitter Post