Oracle GlassFish Server 3.0.1 < 3.0.1.7 / 3.1.2 < 3.1.2.5 Multiple Vulnerabilities (April 2013 CPU)

Medium Nessus Plugin ID 66804

Synopsis

The remote web server is affected by multiple vulnerabilities.

Description

The version of GlassFish Server running on the remote host is affected by multiple vulnerabilities :

- Cross-site scripting (XSS) vulnerabilities exist in its admin and rest interface. These vulnerabilities permit JavaScript to be run in the context of GlassFish, which may result in credentials of authenticated users being stolen. (CVE-2013-1508, CVE-2013-1515)

- A cross-site request forgery (CSRF) vulnerability exists in its REST interface. An authenticated user may be tricked into visiting a web page that leverages this vulnerability.

- A JSF source exposure vulnerability exists that affects confidentiality.

Solution

Upgrade to GlassFish Server 3.0.1.7 / 3.1.2.5 or later.

See Also

http://www.nessus.org/u?c0f55176

http://www.nessus.org/u?5ddb666a

Plugin Details

Severity: Medium

ID: 66804

File Name: glassfish_cpu_apr_2013.nasl

Version: 1.10

Type: remote

Family: Web Servers

Published: 2013/06/05

Modified: 2018/11/15

Dependencies: 55929

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:oracle:glassfish_server

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2013/04/16

Vulnerability Publication Date: 2013/04/16

Reference Information

CVE: CVE-2013-1508, CVE-2013-1515

BID: 59143, 59151

CWE: 20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990