Lucene search

769c9ae7-73c3-4e47-ae19-903170fc3eb8NVD:CVE-2024-7312

HistorySep 11, 2024 - 4:15 p.m.

CVE-2024-7312

2024-09-1116:15:08

CWE-601

769c9ae7-73c3-4e47-ae19-903170fc3eb8

web.nvd.nist.gov

payara platform

open redirect

session hijacking

vulnerability

url redirection

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

17.7%

JSON

URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session Hijacking.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.2020.2 before 5.2022.5, from 5.20.0 before 5.67.0, from 4.1.2.191.0 before 4.1.2.191.50.

Affected configurations

Nvd

Node

payarapayaraRange4.1.2.191.0–4.1.2.191.50community

payarapayaraRange5.20.0–5.67.0enterprise

payarapayaraRange5.2020.2–5.2022.5community

payarapayaraRange6.0.0–6.18.0enterprise

payarapayaraRange6.2022.1–6.2024.9community

VendorProductVersionCPE
payarapayara*cpe:2.3:a:payara:payara:*:*:*:*:community:*:*:*
payarapayara*cpe:2.3:a:payara:payara:*:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
payara	payara	*	cpe:2.3:a:payara:payara:::::community:::*
payara	payara	*	cpe:2.3:a:payara:payara:::::enterprise:::*

References

docs.payara.fish/enterprise/docs/5.67.0/Release%20Notes/Release%20Notes%205.67.0.html

docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.18.0.html

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

17.7%

JSON

Related for NVD:CVE-2024-7312