CVE-2018-2911: High severity glassfish vulnerability

Published Oct 17, 2018

Updated

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Java Server Faces). The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle GlassFish Server accessible data as well as unauthorized access to critical data or complete access to all Oracle GlassFish Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L).

Affected Software

1 affected component

Oracle GlassFish Server=3.1.2

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Event History

Oct 17, 2018

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-2911?

CVE-2018-2911 has been classified as a critical vulnerability due to its ease of exploitation and potential impact.

How do I fix CVE-2018-2911?

To fix CVE-2018-2911, upgrade Oracle GlassFish Server to version 3.1.3 or later.

Who is affected by CVE-2018-2911?

CVE-2018-2911 affects users and organizations running Oracle GlassFish Server version 3.1.2.

What type of attacking vector does CVE-2018-2911 use?

CVE-2018-2911 can be exploited by unauthenticated attackers with network access via HTTP.

What component of Oracle Fusion Middleware does CVE-2018-2911 impact?

CVE-2018-2911 impacts the Java Server Faces component of Oracle GlassFish Server.