Remote Code Execution (RCE)

2017-03-2705:13:34

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.965 High

EPSS

Percentile

99.6%

JSON

Glassfish is vulnerable to remote code execution (RCE). A malicious user can log into the admin account by passing null as the password. The user once logged in can deploy and execute an arbitrary war file.

CPENameOperatorVersion
admin-config-apile3.1.1
admin-config-apile3.1.1-b09
admin-config-apile3.1
admin-config-apile3.0.1
security core classeseq3.1.1-b01
security core classesle3.1.1
security core classesle3.1
security core classesle3.0.1

Name	Operator	Version
admin-config-api	le	3.1.1
admin-config-api	le	3.1.1-b09
admin-config-api	le	3.1
admin-config-api	le	3.0.1
security core classes	eq	3.1.1-b01
security core classes	le	3.1.1
security core classes	le	3.1
security core classes	le	3.0.1