CVE-2017-3239

LOW

Oracle GlassFish Server 3.0.1 and 3.1.2 - Unauthorized Read Access to Sensitive Data

Title source: llm

Description

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GlassFish Server executes to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GlassFish Server accessible data. CVSS v3.0 Base Score 3.3 (Confidentiality impacts).

References (2)

Core 2

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/95493

Patch, Vendor Advisory x_refsource_confirm

http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html

Scores

CVSS v3 3.3

EPSS 0.0042

EPSS Percentile 34.0%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-200

Status published

Products (4)

Oracle/GlassFish Server 3.0.1

Oracle/GlassFish Server 3.1.2

oracle/glassfish_server 3.0.1

oracle/glassfish_server 3.1.2

Published Jan 27, 2017

Tracked Since Feb 18, 2026