# CVE-2017-3239: Oracle GlassFish Server information disclosure in Administration component

Source: https://junglewise.ai/threats/cve-2017-3239-oracle-glassfish-server-information-disclosure-in-administration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-27. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-3239 · Severity: low · CVSS 3.3 · Published 2017-01-27

A vulnerability in the Administration subcomponent of Oracle GlassFish Server could allow an unauthorized user to access sensitive information. An attacker who already has basic access to the server's underlying operating system can exploit this flaw to read a subset of the application server's data. This could lead to the exposure of configuration details or other internal information, though it does not allow the attacker to modify data or shut down the service.

Technologies: [Oracle Glassfish Server](https://junglewise.ai/threats/technologies/glassfish-server). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2017-3239 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-3239 being exploited in the wild.

**How severe is CVE-2017-3239?** Low severity, with a CVSS score of 3.3, published 27 January 2017.

**Which products and versions are affected?** Oracle Glassfish Server 3.0.1, 3.1.2.

**Is there a fix for CVE-2017-3239?** A patch was published on 2017-01-17: Addressed in Oracle January 2017 Critical Patch Update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-3239 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2017-3239?** Check whether you run Oracle Glassfish Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability (CWE-200) exists in the Administration subcomponent of Oracle GlassFish Server versions 3.0.1 and 3.1.2. The flaw is categorized as easily exploitable but requires the attacker to have local logon credentials to the infrastructure where the server is executing (Local attack vector). Successful exploitation allows a low-privileged attacker to gain unauthorized read access to a subset of data accessible by the GlassFish Server process. The vulnerability has a CVSS v3.0 base score of 3.3, reflecting low confidentiality impact with no impact on integrity or availability. Oracle addressed this issue in the January 2017 Critical Patch Update.

## Affected products

- Oracle GlassFish Server 3.0.1, 3.1.2

## Timeline

- 2017-01-27: advisory: Initial NVD publication
- 2017-01-17: patched: Addressed in Oracle January 2017 Critical Patch Update

## References

- [http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html](http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html)
- [http://www.securityfocus.com/bid/95493](http://www.securityfocus.com/bid/95493)

## Related threats

- [Oracle GlassFish Server security vulnerability in Security subcomponent](https://junglewise.ai/threats/cve-2017-3250-oracle-glassfish-server-security-vulnerability-in-security)
- [Oracle GlassFish Server security vulnerability in Security component](https://junglewise.ai/threats/cve-2017-3249-oracle-glassfish-server-security-vulnerability-in-security)
- [Oracle GlassFish Server unauthorized data modification in Core subcomponent](https://junglewise.ai/threats/cve-2017-3247-oracle-glassfish-server-unauthorized-data-modification-in-core)
- [Oracle GlassFish Server compromise in Security subcomponent](https://junglewise.ai/threats/cve-2016-5528-oracle-glassfish-server-compromise-in-security-subcomponent)