Eclipse Glassfish improperly handles http parameters
In Eclipse Glassfish versions before 7.0.17, the Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is `/management/domain`. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-9329US | medium6.1 | — | ||
In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/d… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/eclipse-ee4j/glassfishPACKAGE
- https://github.com/eclipse-ee4j/glassfish/commit/6ca35eee2ba90a8108984b27bec33f9cc50cd83bWEB
- https://github.com/eclipse-ee4j/glassfish/pull/25106WEB
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/232WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-9329ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan