GitHub Advisoryadvisory · Maven

GHSA-jq3f-mfmg-747x Eclipse Glassfish improperly handles http parameters

MEDIUM Published 2024-09-30 Modified 2024-10-07 Official page ↗
Aliases
CVE-2024-9329
Ecosystem
Maven
Packages
org.glassfish.main.admin:rest-service
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-233, CWE-601
Reviewed
2024-09-30

Affected packages

• Maven org.glassfish.main.admin:rest-service: < 7.0.17 → fixed in 7.0.17

Description

In Eclipse Glassfish versions before 7.0.17, the Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is `/management/domain`. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

Related

Alias · CVE (1)

  • CVE-2024-9329 In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when… vulnerability

Weakness · CWE (2)

  • CWE-233 Improper Handling of Parameters weakness
  • CWE-601 URL Redirection to Untrusted Site weakness

References