CVE-2017-10385 in GlassFish Server
Summary
by MITRE
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Oracle GlassFish Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS 3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 01/17/2021
The vulnerability identified as CVE-2017-10385 resides within Oracle GlassFish Server's Web Container component, which forms part of Oracle Fusion Middleware suite. This particular flaw affects specifically version 3.0.1 and 3.1.2 of the GlassFish Server, representing a significant security weakness that could be exploited by malicious actors without requiring authentication credentials. The vulnerability's classification as easily exploitable indicates that attackers can leverage standard network protocols to launch attacks, making it particularly dangerous in environments where such servers are exposed to external networks. The CVSS 3.0 scoring system assigns a base score of 6.3, reflecting medium severity with balanced impacts across confidentiality, integrity, and availability vectors.
The technical nature of this vulnerability stems from insufficient input validation within the Web Container's HTTP processing capabilities, allowing attackers to manipulate requests in ways that could bypass normal access controls. The requirement for human interaction suggests that while the initial exploitation may be automated, some form of user involvement or specific conditions must be met for complete compromise. This characteristic places the vulnerability in the category of those that require social engineering or specific environmental factors to achieve full exploitation potential. The attack vector through HTTP protocols means that any system running vulnerable GlassFish Server versions and accessible over network connections represents a potential target for this type of assault.
Operational impact of CVE-2017-10385 extends across multiple security domains, enabling unauthorized modification of data through update, insert, or delete operations on accessible server data. The confidentiality aspect allows attackers to gain read access to sensitive information that should otherwise remain restricted, while the availability impact can manifest as partial denial of service conditions that disrupt legitimate user access to server resources. These combined effects create a comprehensive threat that can undermine the integrity of server operations, compromise sensitive data, and potentially disrupt business continuity. The partial denial of service component specifically indicates that attackers could cause system instability or reduced functionality without completely taking the server offline, making detection more challenging and recovery more complex.
Security professionals should consider implementing network segmentation strategies to limit exposure of vulnerable GlassFish Server instances to external networks, while also ensuring that all systems are updated to patched versions that address this specific vulnerability. The ATT&CK framework classification for such vulnerabilities would typically fall under privilege escalation and credential access categories, as the ability to modify or read data represents fundamental security breaches that could lead to further compromise. Organizations should also implement monitoring solutions that can detect anomalous HTTP traffic patterns that might indicate exploitation attempts, and maintain regular vulnerability assessment programs to identify and remediate similar issues before they can be exploited in production environments. CWE (Common Weakness Enumeration) categorizes this vulnerability under weakness 20, which covers input validation issues, specifically highlighting the importance of proper sanitization of HTTP request parameters to prevent such exploitation scenarios.