What is CVE-2021-3314?

CVE-2021-3314 is a medium-severity vulnerability in Oracle Glassfish Server, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2021-06-25.

How severe is CVE-2021-3314?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Is CVE-2021-3314 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Oracle Glassfish Server

CVE-2021-3314

Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.009 (58.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Oracle Glassfish_server
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-3314?: CVE-2021-3314 is a medium-severity vulnerability in Oracle Glassfish Server, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2021-06-25.
How severe is CVE-2021-3314?: Medium severity. CVSS v3 base score is 6.1 out of 10.
Is CVE-2021-3314 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.