CVE-2017-10393 in GlassFish Server
Summary
by MITRE
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Oracle GlassFish Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS 3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 01/17/2021
The vulnerability identified as CVE-2017-10393 resides within Oracle GlassFish Server's Web Container component, specifically affecting versions 3.0.1 and 3.1.2 of the Fusion Middleware suite. This represents a significant security weakness that demonstrates the critical importance of proper input validation and access control mechanisms in enterprise application servers. The vulnerability's classification as easily exploitable indicates that attackers can leverage standard network-based attack vectors without requiring specialized tools or extensive preparation, making it particularly dangerous in production environments where such servers are publicly accessible.
The technical flaw manifests as a weakness in the Web Container's handling of HTTP requests, allowing unauthenticated attackers to gain unauthorized access to server resources. This vulnerability operates through a combination of insufficient authentication checks and inadequate input sanitization that permits malicious actors to manipulate server behavior through carefully crafted HTTP requests. The CVSS 3.0 score of 6.3 reflects the balanced impact across confidentiality, integrity, and availability aspects, with low attack complexity and the requirement for human interaction from an unwitting user. This human interaction element suggests that the vulnerability may be exploited through social engineering tactics where users inadvertently trigger the malicious conditions.
The operational impact of this vulnerability extends beyond simple data access, encompassing multiple attack vectors that can compromise server integrity and availability. Successful exploitation enables attackers to perform unauthorized data modifications including updates, inserts, and deletions within accessible server data stores, while simultaneously providing read access to sensitive information. The partial denial of service component indicates that attackers can disrupt server operations without completely shutting down the system, potentially leading to service degradation that impacts business continuity. This vulnerability directly maps to CWE-287 (Improper Authentication) and CWE-311 (Missing Encryption of Sensitive Data) within the CWE taxonomy, demonstrating how authentication failures can compound into broader security breaches.
Organizations running affected GlassFish Server versions face significant risk exposure that requires immediate remediation efforts. The vulnerability's network accessibility means that any server exposed to external networks becomes immediately vulnerable to exploitation. Mitigation strategies should prioritize immediate patching of affected versions, implementation of network segmentation to limit access to critical server components, and deployment of web application firewalls to monitor and filter suspicious HTTP traffic. Additionally, organizations should conduct comprehensive security assessments to identify any other potentially vulnerable components within their Fusion Middleware infrastructure, as this vulnerability may indicate broader architectural weaknesses in the server's security posture. The ATT&CK framework categorizes this vulnerability under T1190 (Exploit Public-Facing Application) and T1071.004 (Application Layer Protocol: Web Protocols), highlighting the need for defensive measures that address both network-level and application-level threats.