CVE-2017-10400: Medium severity glassfish vulnerability

Published Oct 19, 2017

Updated

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration Graphical User Interface). The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Oracle GlassFish Server accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).

Affected Software

1 affected component

Oracle GlassFish Server=3.1.2

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Event History

Oct 19, 2017

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-10400?

CVE-2017-10400 has a high severity rating due to its easily exploitable nature by unauthenticated attackers.

How do I fix CVE-2017-10400?

To fix CVE-2017-10400, users should upgrade Oracle GlassFish Server to the latest version that addresses this vulnerability.

Who is affected by CVE-2017-10400?

CVE-2017-10400 affects users running Oracle GlassFish Server version 3.1.2.

Can CVE-2017-10400 be exploited remotely?

Yes, CVE-2017-10400 can be exploited remotely via HTTP by unauthenticated attackers.

What components are impacted by CVE-2017-10400?

CVE-2017-10400 impacts the Administration Graphical User Interface component of the Oracle GlassFish Server.