CVE-2024-8646

2024-09-1114:15:14

CWE-601

eclipse

web.nvd.nist.gov

eclipse glassfish

url redirection

untrusted sites

apache code

vulnerability

root context

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.3

Confidence

High

EPSS

0.005

Percentile

77.5%

JSON

In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed.
This vulnerability is caused by the vulnerability (CVE-2023-41080) in the Apache code included in GlassFish.
This vulnerability only affects applications that are explicitly deployed to the root context (‘/’).

Affected configurations

Nvd

Node

eclipseglassfishRange5.1.0–7.0.10

VendorProductVersionCPE
eclipseglassfish*cpe:2.3:a:eclipse:glassfish:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
eclipse	glassfish	*	cpe:2.3:a:eclipse:glassfish::::::::

CNA Affected

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2/",
    "defaultStatus": "unaffected",
    "packageName": "org.glassfish.main.distributions:glassfish",
    "product": "Eclipse Glassfish",
    "repo": "https://github.com/eclipse-ee4j/glassfish",
    "vendor": "Eclipse Foundation",
    "versions": [
      {
        "lessThan": "7.0.10",
        "status": "affected",
        "version": "5.1.0",
        "versionType": "semver"
      }
    ]
  }
]