Unspecified vulnerability in the GlassFish Enterprise Server component in Oracle Sun Products Suite GlassFish Enterprise Server 3.1.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Web Container.

The version of GlassFish Server running on the remote host is affected by multiple vulnerabilities :

  - A cross-site request forgery (CSRF) vulnerability in its     REST interface. An authenticated user can be tricked     into visiting a web page that leverages this     vulnerability to upload an arbitrary WAR file to the     GlassFish server, which is then executed with     GlassFish's     credentials. (CVE-2012-0550)

  - A cross-site scripting (XSS) vulnerability in its     administrative interface. This vulnerability permits     JavaScript to be run in the context of the GlassFish     administrative interface, which may result in the     credentials of an authenticated user being stolen for     use in subsequent attacks. (CVE-2012-0551)

Detections

Analytics

CVE-2012-0550

critical

Tenable Plugins

high