CVE-2018-14324 - The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account

Back Back to CVE browser

CRITICAL

The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account

Published Jul 16, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 4.29%

Description

The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account. This allows remote attackers to obtain potentially sensitive information, perform database operations, or manipulate the demo via a JMX RMI session, aka a "jmx_rmi remote monitoring and control problem." NOTE: this is not an Oracle supported product.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-798

Hard-coded Credentials

References (2)

http://www.securitytracker.com/id/1041292
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://github.com/eclipse-ee4j/glassfish/issues/22500
x_refsource_CONFIRM

Link	Providers	Tags
http://www.securitytracker.com/id/1041292		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://github.com/eclipse-ee4j/glassfish/issues/22500		x_refsource_CONFIRM