2 lines
2.8 KiB
JSON
2 lines
2.8 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Glassfish","repo":"https://github.com/eclipse-ee4j/glassfish","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"6.2.5","status":"unknown","version":"5.1.0","versionType":"semver"},{"lessThan":"7.0.26","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThan":"7.1.1","status":"affected","version":"7.1.0","versionType":"semver"},{"lessThan":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:eclipse:glassfish:*:*:*:*:*:*:*:*","matchCriteriaId":"589D2C3E-E047-4F09-B0CC-878611D553DB","versionEndExcluding":"8.0.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown."},{"lang":"es","value":"Una vulnerabilidad de ejecución remota de código (RCE) autenticada fue identificada en la Consola de Administración de GlassFish. Un usuario con acceso al panel puede enviar solicitudes manipuladas que permiten la ejecución de comandos arbitrarios del sistema operativo con los privilegios del usuario del servicio de la aplicación."}],"id":"CVE-2026-2586","lastModified":"2026-07-24T12:10:00.210","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"emo@eclipse.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-2586","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-19T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-05-19T15:16:28.413","references":[{"source":"emo@eclipse.org","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.eclipse.org/security/cve-assignment/-/issues/87"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-917"}],"source":"emo@eclipse.org","type":"Secondary"}]}
|