Eclipse GlassFish code issues and vulnerabilities

Eclipse GlassFish is an open source application server from the Eclipse Foundation. A code issue vulnerability exists in Eclipse GlassFish versions 6.2.5 and later, which stems from the risk of a server-side request forgery attack on specific endpoints...

CVE-2024-9408: Server-Side Request Forgery (SSRF)

In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints...

CVE-2024-9343: Improper Neutralization of Input During Web Page Generation

In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console...

CVE-2024-10032: Improper Neutralization of Input During Web Page Generation

In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console...

CVE-2024-10031: Improper Neutralization of Input During Web Page Generation

In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating system...

CVE-2024-10029: Improper Neutralization of Input During Web Page Generation

In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console...

Eclipse GlassFish Cross-Site Scripting Vulnerabilities

Eclipse GlassFish is an open source application server from the Eclipse Foundation. A cross-site scripting vulnerability exists in Eclipse GlassFish version 7.0.15, which stems from the fact that modifying a configuration file could lead to a stored cross-site scripting attack...

VulnCheck KEV: CVE-2013-3827

Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0...

CVE-2024-9329

In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal...

CVE-2024-8646

In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed. This vulnerability is caused by the vulnerability CVE-2023-41080 in the Apache code included in GlassFish. This vulnerability only affects applications that are explicitly deployed to the ro...

CVE-2023-5763

In Eclipse Glassfish 5 or 6, running with old versions of JDK lower than 6u211, or 7u201, or 8u191, allows remote attackers to load malicious code on the server via access to insecure ORB listeners...

CVE-2022-2712

In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed...

CVE-2013-5816

Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2 allows remote attackers to affect availability via unknown vectors related to Metro...

CVE-2012-1712

Directory traversal vulnerability in the Liferay component in Oracle Sun GlassFish Web Space Server before 10.0 Update 7 Patch 2 has unknown impact and attack vectors...

Eclipse Glassfish URL Redirection

The vulnerability of the Eclipse Glassfish application server is related to the redirection of URLs to an unreliable website. Exploiting this vulnerability allows a hacker to redirect users to any given URL address...

Eclipse Glassfish improperly handles http parameters

In Eclipse Glassfish versions before 7.0.17, the Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is /management/domain. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal...

org.glassfish.main.featuresets:glassfish (6.0.0-rc2), org.glassfish.main.featuresets:nucleus (6.0.0-rc2) +1 more potentially affected by CVE-2024-9329 via org.glassfish.main.admin:rest-service (6.0.0-rc2)

org.glassfish.main.admin:rest-service MAVEN version 6.0.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admin:rest-service and may be impacted: - org.glassfish.main.featuresets:glassfish 6.0.0-rc2 -...

org.glassfish.main.featuresets:glassfish (5.1.0-rc2), org.glassfish.main.featuresets:nucleus (5.1.0-rc2) +1 more potentially affected by CVE-2024-9329 via org.glassfish.main.admin:rest-service (5.1.0-rc2)

org.glassfish.main.admin:rest-service MAVEN version 5.1.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admin:rest-service and may be impacted: - org.glassfish.main.featuresets:glassfish 5.1.0-rc2 -...

GHSA-JQ3F-MFMG-747X Eclipse Glassfish improperly handles http parameters

In Eclipse Glassfish versions before 7.0.17, the Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is /management/domain. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal...

org.glassfish.main.featuresets:glassfish (6.0.0-rc4), org.glassfish.main.featuresets:nucleus (6.0.0-rc4) +1 more potentially affected by CVE-2024-9329 via org.glassfish.main.admin:rest-service (6.0.0-rc4)

org.glassfish.main.admin:rest-service MAVEN version 6.0.0-rc4 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admin:rest-service and may be impacted: - org.glassfish.main.featuresets:glassfish 6.0.0-rc4 -...