The host is running GlassFish Server and is prone to cross-site scripting vulnerability.

Successful exploitation will allow attackers to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Impact Level: Application

Apply the security updates. http://www.oracle.com/technetwork/topics/security/whatsnew/index.html

The flaw is due to error in the handling of log viewer, which fails to securely output encode logged values. An unauthenticated attacker can trigger the application to log a malicious string by entering the values into the username field.

Oracle GlassFish Server version 2.1.1

• http://packetstormsecurity.org/files/view/103167/SOS-11-009.txt
• http://www.exploit-db.com/exploits/17551/
• http://www.securityfocus.com/archive/1/518923

---

Updated on 2015-03-25