CVE-2023-28462

CRITICAL

Payara Server 4.1.2.191-5.20.0, 5.2020.1-6.2022.1.Alpha3 - Remote Code Execution via JNDI Rebind

Title source: llm

Description

A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community), when Java 1.8u181 and earlier is used, allows remote attackers to load malicious code on the server once a JNDI directory scan is performed.

References (1)

Core 1

Core References

Mitigation, Vendor Advisory

https://blog.payara.fish/vulnerability-affecting-server-environments-on-java-1.8-on-updates-lower-than-1.8u191

Scores

CVSS v3 9.8

EPSS 0.0093

EPSS Percentile 56.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-502

Status published

Products (3)

fish.payara.server/payara-aggregator 5.2020.1 - 6.2022.1.Alpha3Maven

payara/payara_server 4.1.2.191 - 5.0.0

payara/payara_server 5.2020.1

Published Mar 30, 2023

Tracked Since Feb 18, 2026