CVE-2024-8646 Eclipse Glassfish: URL redirection vulnerability to untrusted sites

2024-09-1113:26:47

CWE-601

eclipse

www.cve.org

eclipse glassfish

url redirection

untrusted sites

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.005

Percentile

77.5%

JSON

In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed.
This vulnerability is caused by the vulnerability (CVE-2023-41080) in the Apache code included in GlassFish.
This vulnerability only affects applications that are explicitly deployed to the root context (‘/’).

CNA Affected

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2/",
    "defaultStatus": "unaffected",
    "packageName": "org.glassfish.main.distributions:glassfish",
    "product": "Eclipse Glassfish",
    "repo": "https://github.com/eclipse-ee4j/glassfish",
    "vendor": "Eclipse Foundation",
    "versions": [
      {
        "lessThan": "7.0.10",
        "status": "affected",
        "version": "5.1.0",
        "versionType": "semver"
      }
    ]
  }
]