CVE-2023-28462

2023-03-3020:15:07

[email protected]

web.nvd.nist.gov

jndi rebind operation

java 1.8u181

remote attackers

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.003

Percentile

65.8%

JSON

A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community), when Java 1.8u181 and earlier is used, allows remote attackers to load malicious code on the server once a JNDI directory scan is performed.

Affected configurations

Nvd

Node

payarapayara_serverRange4.1.2.191–5.0.0enterprise

payarapayara_serverRange5.20.0≥enterprise

payarapayara_serverRange5.2020.1≥community

AND

oraclejdkMatch1.8.0update181

VendorProductVersionCPE
payarapayara_server*cpe:2.3:a:payara:payara_server:*:*:*:*:enterprise:*:*:*
payarapayara_server*cpe:2.3:a:payara:payara_server:*:*:*:*:community:*:*:*
oraclejdk1.8.0cpe:2.3:a:oracle:jdk:1.8.0:update181:*:*:*:*:*:*

Vendor	Product	Version	CPE
payara	payara_server	*	cpe:2.3:a:payara:payara_server:::::enterprise:::*
payara	payara_server	*	cpe:2.3:a:payara:payara_server:::::community:::*
oracle	jdk	1.8.0	cpe:2.3:a:oracle:jdk:1.8.0:update181::::::