GitHub Advisoryadvisory · Maven

GHSA-99f7-hp6j-v6q4 Eclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts

MEDIUM Published 2025-07-16 Modified 2025-07-18 Official page ↗
Aliases
CVE-2024-9342
Ecosystem
Maven
Packages
org.glassfish.main.admingui:console-common
Severity
Moderate
CVSS vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Weaknesses
CWE-307
Reviewed
2025-07-18

Affected packages

• Maven org.glassfish.main.admingui:console-common: <= 7.0.25 (no fix yet)

Description

In Eclipse GlassFish version 7.0.16 or earlier, it is possible to perform login brute force attacks as there is no limitation on the number of failed login attempts.

Related

Alias · CVE (1)

  • CVE-2024-9342 In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of… vulnerability

Weakness · CWE (1)

  • CWE-307 Improper Restriction of Excessive Authentication Attempts weakness

References