CVE-2023-5763 Glassfish remote code execution

What is CVE-2023-5763?

CVE-2023-5763 is a medium-severity unsafe deserialization vulnerability in Eclipse Foundation Glassfish, published on 3 Nov 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners.

Weakness: CWE-913, CWE-20

Which versions are affected by CVE-2023-5763?

2 open source packages ship an affected version, including org.glassfish.main.orb:orb-connector. It affects 1 product.

Products include Eclipse Glassfish.

How do I fix CVE-2023-5763?

Upgrade org.glassfish.main.orb:orb-connector to 7.0.0 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2023-5763 being exploited?

There is no known exploitation of CVE-2023-5763 in the wild and no public exploit code.

Other vulnerabilities in Eclipse Foundation Glassfish

• CVE-2026-12605 Server-side request forgery in Eclipse GlassFish Critical 9.6
• CVE-2026-2587 GlassFish's gadget handler is vulnerable to RCE Critical 9.6
• CVE-2026-2586 GlassFish's Administration Console is Vulnerable to RCE Critical 9.1
• CVE-2024-9408 Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints High 8.9
• CVE-2024-9329 Glassfish redirect to untrusted site Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2mw4-wj8c-7f93.