Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1,
    3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and
    12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1
    allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web
    Container. (CVE-2013-3827)

Oracle GlassFish versions 2.1.1, 3.0.1, and 3.1.2 are affected by the following vulnerabilities :/n/n - The Java Server Faces is prone to multiple directory traversal vulnerabilities/n - The Metro component is affected by a remote security vulnerability which can be exploited via SOAP/n - The Metro component is also affected by a potential DoS condition which can be exploited via SOAP/n

The remote web server contains a JavaServer Faces application that is affected by multiple partial directory traversal vulnerabilities :

  - A defect exists in the handling of a resource identifier     that allows for directory traversal within the     application.

  - A defect exists in the handling of a library name that     allows for directory traversal within the application.

Note that the application may also be affected by a ViewState HMAC non-constant verification weakness; however, Nessus has not tested for this. 

Note that this plugin will only report the first vulnerable application.

The version of GlassFish Server running on the remote host is affected by multiple vulnerabilities in the following components :

  - Java Server Faces
  - Metro

ID	Name	Product	Family	Severity
417826	SCA: security update for org.glassfish:javax.faces (GHSA-q388-j7cw-ff7w)	Tenable Cloud Security	SCA Checks	medium
417826	SCA: security update for org.glassfish:javax.faces (GHSA-q388-j7cw-ff7w)	Tenable Self-Hosted Container Security	SCA Checks	medium
9000	Oracle GlassFish Server 2.1.1 / 3.0.1 / 3.1.2 Multiple Vulnerabilities (October 2013 CPU)	Nessus Network Monitor	Web Servers	medium
70963	Oracle JavaServer Faces Multiple Partial Directory Traversals	Nessus	CGI abuses	medium
70482	Oracle GlassFish Server Multiple Vulnerabilities (October 2013 CPU)	Nessus	Web Servers	medium

Detections

Analytics

CVE-2013-3827

medium

Tenable Plugins

medium

medium

medium

medium

medium