CVE-2018-14324

{"id": "CVE-2018-14324", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2018-07-16T18:29:00.383", "references": [{"url": "http://www.securitytracker.com/id/1041292", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://github.com/eclipse-ee4j/glassfish/issues/22500", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account. This allows remote attackers to obtain potentially sensitive information, perform database operations, or manipulate the demo via a JMX RMI session, aka a \"jmx_rmi remote monitoring and control problem.\" NOTE: this is not an Oracle supported product."}, {"lang": "es", "value": "La caracter\u00edstica demo en Oracle GlassFish Open Source Edition 5.0 tiene el puerto TCP 7676 abierto por defecto con una contrase\u00f1a \"admin\" para la cuenta de administrador. Esto permite que atacantes remotos obtengan informaci\u00f3n potencialmente sensible, realicen operaciones en la base de datos o manipulen la demo mediante una sesi\u00f3n JMX RMI. Esto tambi\u00e9n se conoce como \"jmx_rmi remote monitoring and control problem\". NOTA: este producto no cuenta con soporte por parte de Oracle."}], "lastModified": "2019-05-20T21:29:00.533", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:glassfish_server:5.0:*:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "2FC11750-55CC-444A-83C6-A98CFEECDFFE"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}