Detections
Analytics
Oracle GlassFish Server 3.0.1 < 3.0.1.7 / 3.1.2 < 3.1.2.5 Multiple Vulnerabilities (April 2013 CPU)
medium Nessus Plugin ID 66804
Language:
Synopsis
The remote web server is affected by multiple vulnerabilities.Description
The version of GlassFish Server running on the remote host is affected by multiple vulnerabilities :- Cross-site scripting (XSS) vulnerabilities exist in its admin and rest interface. These vulnerabilities permit JavaScript to be run in the context of GlassFish, which may result in credentials of authenticated users being stolen. (CVE-2013-1508, CVE-2013-1515)
- A cross-site request forgery (CSRF) vulnerability exists in its REST interface. An authenticated user may be tricked into visiting a web page that leverages this vulnerability.
- A JSF source exposure vulnerability exists that affects confidentiality.
Solution
Upgrade to GlassFish Server 3.0.1.7 / 3.1.2.5 or later.See Also
Plugin Details
Severity: Medium
ID: 66804
File Name: glassfish_cpu_apr_2013.nasl
Version: 1.10
Type: remote
Family: Web Servers
Published: 6/5/2013
Updated: 11/15/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 2.5
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:oracle:glassfish_server
Required KB Items: www/glassfish, www/glassfish/console
Exploit Ease: No known exploits are available
Patch Publication Date: 4/16/2013
Vulnerability Publication Date: 4/16/2013
Reference Information
CVE: CVE-2013-1508, CVE-2013-1515