Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Oracle GlassFish Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS v3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).

Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution.

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GlassFish Server executes to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GlassFish Server accessible data. CVSS v3.0 Base Score 3.3 (Confidentiality impacts).

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data. CVSS v3.0 Base Score 4.3 (Integrity impacts).

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Oracle GlassFish Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS v3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Oracle GlassFish Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS v3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GlassFish Server. While the vulnerability is in Oracle GlassFish Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle GlassFish Server. CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts).

Oracle GlassFish versions 2.1.1.x prior to 2.1.1.30, 3.0.1.x prior to 3.0.1.15, and 3.1.2.x prior to 3.1.2.16 are affected by the following vulnerabilities :

 - An unspecified flaw exists related to the Security subcomponent.  This may allow a remote attacker to potentially execute arbitrary code.  No further details have been provided by the vendor. (CVE-2016-5528)
 - An unspecified flaw exists related to the Administration subcomponent.  This may allow a local attacker to gain access to potentially sensitive information.  No further details have been provided by the vendor. (CVE-2017-3239)
 - An unspecified flaw exists related to the Core subcomponent.  This may allow a context-dependent attacker to have an impact on integrity.  No further details have been provided by the vendor. (CVE-2017-3247)
 - An unspecified flaw exists related to the Security subcomponent.  This may allow a remote attacker to have an impact on confidentiality, integrity, and availability.  No further details have been provided by the vendor. (CVE-2017-3249)
 - An unspecified flaw exists related to the Security subcomponent.  This may allow a remote attacker to have an impact on confidentiality, integrity, and availability.  No further details have been provided by the vendor. (CVE-2017-3250)

According to its self-reported version number, the Oracle GlassFish Server running on the remote host is 2.1.1.x prior to 2.1.1.30, 3.0.1.x prior to 3.0.1.15, or 3.1.2.x prior to 3.1.2.16. It is, therefore, affected by multiple vulnerabilities : 

  - An unspecified flaw exists in the Security subcomponent     that allows an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2016-5528)

  - An unspecified flaw exists in the Administration     subcomponent that allows a local attacker attacker to     disclose sensitive information. Note that this     vulnerability does not affect the 2.1.1.x version     branch. (CVE-2017-3239)

  - An unspecified flaw exists in the Core subcomponent that     allows an unauthenticated, remote attacker to perform     unauthorized updates, inserts, or deletion of data over     SMTP. (CVE-2017-3247)

  - An unspecified flaw exists in the Security subcomponent     that allows an unauthenticated, remote attacker to     perform unauthorized updates, inserts, or deletion of     data over LDAP. Additionally, the attacker can     potentially cause a partial denial of service condition.
    (CVE-2017-3249) 

  - An unspecified flaw exists in the Security subcomponent     that allows an unauthenticated, remote attacker to     perform unauthorized updates, inserts, or deletion of     data over HTTP. Additionally, the attacker can     potentially cause a partial denial of service condition.
    (CVE-2017-3250)

ID	Name	Product	Family	Severity
119274	FreeBSD : payara -- Multiple vulnerabilities (d70c9e18-f340-11e8-be46-0019dbb15b3f)	Nessus	FreeBSD Local Security Checks	critical
9947	Oracle GlassFish Server 2.1.1.x < 2.1.1.30 / 3.0.1.x < 3.0.1.15 / 3.1.2.x < 3.1.2.16 Multiple Vulnerabilities (January 2017 CPU)	Nessus Network Monitor	Web Servers	high
96624	Oracle GlassFish Server 2.1.1.x < 2.1.1.30 / 3.0.1.x < 3.0.1.15 / 3.1.2.x < 3.1.2.16 Multiple Vulnerabilities (January 2017 CPU)	Nessus	Web Servers	high

Detections

Analytics

CVE-2017-3249

high

Tenable Plugins

critical

high

high