{"id":"CVE-2023-5763","aliases":["EUVD-2023-2849","GHSA-2mw4-wj8c-7f93"],"status":"published","title":"Glassfish remote code execution","description":"In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or \u003c 7u201, or \u003c 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00814,"percentile":0.57296,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-913"],"published":"2023-11-03T06:40:43Z","modified":"2026-10-28T02:30:48Z","fixes":[{"ecosystem":"Maven","package":"org.glassfish.main.orb:orb-connector","fixed_in":["7.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.glassfish.main.orb:orb-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"7.0.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.glassfish.main.orb:orb-connector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"7.0.0"}]}],"versions":["5.0","5.0.1","5.1.0","5.1.0-RC1","5.1.0-RC2","6.0.0","6.0.0-M1","6.0.0-RC1","6.0.0-RC2","6.0.0-RC3","6.0.0-RC4","6.1.0","6.2.0","6.2.1","6.2.2","6.2.3","6.2.4","6.2.5","7.0.0-M1","7.0.0-M10","7.0.0-M2","7.0.0-M3","7.0.0-M4"]}],"products":[{"vendor":"eclipse","product":"glassfish"},{"vendor":"eclipse foundation","product":"glassfish"}],"references":[{"url":"https://glassfish.org/docs/latest/security-guide.html#securing-glassfish-server","tags":["x_transferred","Product","web"]},{"url":"https://gitlab.eclipse.org/security/cve-assignement/-/issues/14","tags":["x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5763","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2mw4-wj8c-7f93"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5763.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-5763","title":"Glassfish remote code execution","description":"In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or \u003c 7u201, or \u003c 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners.\n","status":"published","published":"2023-11-03T06:40:43.441Z","modified":"2024-09-05T19:04:31.768Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-913","CWE-20"],"updated_at":"2026-11-02T14:35:16.771348Z"}],"euvd":[{"id":"EUVD-2023-2849","description":"In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or \u003c 7u201, or \u003c 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners.\n","status":"published","published":"2023-11-03T06:40:43Z","modified":"2024-09-05T19:04:31Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:56:02.678796Z"}],"ghsa":[{"id":"GHSA-2mw4-wj8c-7f93","title":"Eclipse Glassfish remote code execution issue","description":"In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or \u003c 7u201, or \u003c 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners.\n","status":"published","published":"2023-11-03T09:32:49Z","modified":"2023-11-14T21:26:26Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-20","CWE-913"],"updated_at":"2026-11-02T14:37:22.040291Z"}],"nvd":[{"id":"CVE-2023-5763","description":"In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or \u003c 7u201, or \u003c 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners.\n","status":"published","published":"2023-11-03T07:15:14.617Z","modified":"2026-06-17T06:49:19.08Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-20","CWE-913"],"updated_at":"2026-11-02T14:08:41.047232Z"}],"osv":[{"id":"CVE-2023-5763","title":"Glassfish remote code execution","description":"In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or \u003c 7u201, or \u003c 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners.\n","status":"published","published":"2023-11-03T06:40:43.441Z","modified":"2026-10-28T02:30:48.524132394Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-20","CWE-913"],"updated_at":"2026-11-02T15:44:36.851042Z"},{"id":"GHSA-2mw4-wj8c-7f93","title":"Eclipse Glassfish remote code execution issue","description":"In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or \u003c 7u201, or \u003c 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners.\n","status":"published","published":"2023-11-03T09:32:49Z","modified":"2024-02-16T08:11:53.682476Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-20","CWE-913"],"updated_at":"2026-11-02T15:46:34.700741Z"}]}}