Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allo…

published 2011-04-20 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-0819

cvss: 10.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 60.9%; EPSS 60.9% chance of exploitation in 30 days, percentile 99.1%
public exploits: 3; Metasploit, Exploit-DB

Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Administration.

Patch / fix

links 1

oracle.com/technetwork/topics/security/cpuapr2011-301950.html advisory

Timeline

2011-04-20 Published
2011-08-04 First public exploit (Metasploit exploit/multi/http/glassfish_deployer)

Exploit prediction

60.88% chance of exploitation in the next 30 days, higher than 99.1% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/multi/http/glassfish_deployer Sun/Oracle GlassFish Server Authenticated Code Execution metasploit exploit, excellent rank, 2011-08-04
Metasploit auxiliary/scanner/http/glassfish_login GlassFish Brute Force Utility metasploit auxiliary, normal rank
EDB-17615 Sun/Oracle GlassFish Server - (Authenticated) Code Execution (Metasploit) webapps, 2011-08-05

CVSS scores

assigned by	version	score	vector
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

References

oracle.com /technetwork/topics/security/cpuapr2011-301950.html
patch, vendor-advisory
securityreason.com /securityalert/8327
third-party-advisory

Sources

CVE List CVE-2011-0807
NVD CVE-2011-0807

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary