Vulnerability · Published Jun 25, 2021 · Assigned by mitre

CVE-2021-3314

Medium 6.1

In plain English

A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)0.9%top 39.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.gruppotim.it/redteam x_refsource_MISC
https://n4nj0.github.io/advisories/oracle-glassfish-reflected-xss/ x_refsource_MISC