CVE-2018-3152: High severity glassfish vulnerability

Published Oct 17, 2018

Updated

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle GlassFish Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Affected Software

1 affected component

Oracle GlassFish Server=3.1.2

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Event History

Oct 17, 2018

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-3152?

CVE-2018-3152 is considered a critical vulnerability due to its ease of exploitation and the potential for an unauthenticated attacker to compromise the Oracle GlassFish Server.

How do I fix CVE-2018-3152?

To fix CVE-2018-3152, upgrade your Oracle GlassFish Server to a version that is not affected by this vulnerability.

Who is affected by CVE-2018-3152?

All users running Oracle GlassFish Server version 3.1.2 are affected by CVE-2018-3152.

What is the attack vector for CVE-2018-3152?

CVE-2018-3152 can be exploited remotely over HTTP with no authentication required.

Is CVE-2018-3152 easy to exploit?

Yes, CVE-2018-3152 is considered easily exploitable, allowing attackers to compromise the affected server.