{"id":"CVE-2012-0551","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE 7 update 4 and earlier and 6 update 32 and earlier, and the GlassFish Enterprise Server component in Oracle Sun Products Suite GlassFish Enterprise Server 3.1.1, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Web Container or Deployment.","cvssScore":5.8,"cvssVersion":"2.0","cvssVector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","cvssMetrics":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"}],"resolved":"MITIGATED-BY-ENVIRONMENT","published":"2012-05-03","lastModified":"2026-06-16","affectedProducts":[{"vendor":"oracle","product":"glassfish server","version":"3.1.1"},{"vendor":"oracle","product":"jdk","versionEnd":"\u003c=1.6.0","update":"update32"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update22"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update23"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update24"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update25"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update26"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update27"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update29"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update30"},{"vendor":"oracle","product":"jdk","version":"1.6.0","update":"update31"},{"vendor":"oracle","product":"jre","versionEnd":"\u003c=1.6.0","update":"update32"},{"vendor":"oracle","product":"jre","version":"1.6.0","update":"update22"},{"vendor":"oracle","product":"jre","version":"1.6.0","update":"update23"},{"vendor":"oracle","product":"jre","version":"1.6.0","update":"update24"},{"vendor":"oracle","product":"jre","version":"1.6.0","update":"update25"},{"vendor":"oracle","product":"jre","version":"1.6.0","update":"update26"},{"vendor":"oracle","product":"jre","version":"1.6.0","update":"update27"},{"vendor":"oracle","product":"jre","version":"1.6.0","update":"update29"},{"vendor":"oracle","product":"jre","version":"1.6.0","update":"update30"}],"totalAffectedProducts":5,"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html","source":"secalert_us@oracle.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00035.html","source":"secalert_us@oracle.com"},{"url":"http://marc.info/?l=bugtraq\u0026m=134496371727681\u0026w=2","source":"secalert_us@oracle.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0734.html","source":"secalert_us@oracle.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1455.html","source":"secalert_us@oracle.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1456.html","source":"secalert_us@oracle.com"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150","source":"secalert_us@oracle.com"},{"url":"http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html","source":"secalert_us@oracle.com","tags":["Vendor Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html","source":"secalert_us@oracle.com"},{"url":"http://www.securityfocus.com/bid/53136","source":"secalert_us@oracle.com"}],"reasoning":{"decidingSource":"h2-history","decidingReason":"Manual classification assigned status: MITIGATED-BY-ENVIRONMENT","verdicts":[{"rule":"rejected","stage":"identity","outcome":"no-match"},{"rule":"armr-patch-file","stage":"scope","outcome":"no-match"},{"rule":"armr-secure-rule-file","stage":"scope","outcome":"no-match"},{"rule":"manual-classification","stage":"scope","outcome":"no-match"},{"rule":"h2-history","stage":"scope","outcome":"matched","status":"MITIGATED-BY-ENVIRONMENT","detail":"Found in legacy manual classifications","decisive":true}]},"oracleAdvisories":[{"advisory":"Java SE CPU Jun 2012","releaseType":"CPU","quarter":"2012-Q2","url":"https://www.oracle.com/security-alerts/javacpujun2012.html","products":[{"product":"Oracle Java SE","component":"Java Runtime Environment","affectedVersions":"7 Update 4 and before, 6 Update 32 and before"}]},{"advisory":"Oracle Critical Patch Update April 2012","releaseType":"CPU","quarter":"2012-Q2","url":"https://www.oracle.com/security-alerts/cpuapr2012.html","products":[{"product":"Oracle Sun Products Suite","component":"Web Container","affectedVersions":"GlassFish Enterprise Server 3.1.1"}]}],"assessment":{"record":{"state":"active"},"protection":{"level":"full","mechanisms":["environment"]},"action":{"state":"not-needed"},"review":{"state":"human","basis":"manual-review"}},"h2Comments":"## Manual Classification Context\n\n\n**Labels:** HTTP, MULTIPLE, WEB CONTAINER, NO AUTH REMOTE EXPLOIT, DEPLOYMENT, SEE NOTE 2\n\n**Products:** ORACLE JDK, ORACLE SUN PRODUCTS SUITE, JAVA RUNTIME ENVIRONMENT, GLASSFISH ENTERPRISE SERVER, ORACLE JAVA SE","exploits":[{"source":"exploit-db","url":"https://www.exploit-db.com/exploits/18764","title":"Oracle GlassFish Server 3.1.1 (build 12) - Multiple Cross-Site Scripting Vulnerabilities","date":"2012-04-22"}],"signals":{"hasPOC":true,"pocCount":1,"pocSources":["exploit-db"],"firstPOCDate":"2012-04-22"},"kev":{"inKEV":false},"epss":{"available":true,"score":0.11388,"percentile":0.95748},"ssvc":{"available":false}}