GitHub Advisoryadvisory · Maven

GHSA-2mw4-wj8c-7f93 Eclipse Glassfish remote code execution issue

MEDIUM Published 2023-11-03 Modified 2023-11-03 Official page ↗
Aliases
CVE-2023-5763
Ecosystem
Maven
Packages
org.glassfish.main.orb:orb-connector
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-20, CWE-913
Reviewed
2023-11-03

Affected packages

• Maven org.glassfish.main.orb:orb-connector: >= 5.0.0, < 7.0.0 → fixed in 7.0.0

Description

In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners.

Related

Alias · CVE (1)

  • CVE-2023-5763 In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-913 Improper Control of Dynamically-Managed Code Resources weakness

References