GHSA-99f7-hp6j-v6q4

ghsaUSosv

Eclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts

view advisory published 2025-07-16Licence: CC-BY-4.0

In Eclipse GlassFish version 7.0.16 or earlier, it is possible to perform login brute force attacks as there is no limitation on the number of failed login attempts.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-9342US	critical9.8	0.48% (41st)	—	2025-07-16
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 add…

references

External citations — patches, advisories, analysis.

https://github.com/eclipse-ee4j/glassfishPACKAGE
https://gitlab.eclipse.org/security/cve-assignement/-/issues/33WEB
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/231WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-9342ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan