Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2011-5035

CWE-20 — Improper Input Validation9 documents7 sources
Severity
5.0MEDIUM
EPSS
58.6%
top 1.79%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Oracle Glassfish Server
Timeline
PublishedDec 30
Latest updateMay 14

Description

Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

â–¶NVDoracle/glassfish_server3.1.1+2

🔴Vulnerability Details

2
GHSA
GHSA-6mxv-54wx-wppj: Oracle Glassfish 2↗2022-05-14
â–¶
CVEList
CVE-2011-5035: Oracle Glassfish 2↗2011-12-30
â–¶

💥Exploits & PoCs

2
Exploit-DB
PHP Hash Table Collision - Denial of Service (PoC)↗2012-01-03
â–¶
Exploit-DB
MyBulletinBoard (MyBB) 1.1.5 - 'CLIENT-IP' SQL Injection↗2006-07-15
â–¶

📋Vendor Advisories

3
Ubuntu
OpenJDK 6 (ARM) vulnerabilities↗2012-03-01
â–¶
Ubuntu
OpenJDK 6 vulnerabilities↗2012-02-24
â–¶
Red Hat
GlassFish: hash table collisions CPU usage DoS (oCERT-2011-003)↗2011-12-28
â–¶

💬Community

1
Bugzilla
CVE-2011-5035 GlassFish: hash table collisions CPU usage DoS (oCERT-2011-003)↗2012-01-03
â–¶
CVE-2011-5035 (MEDIUM CVSS 5) | Oracle Glassfish 2.1.1 | cvebase.io