Eclipse Glassfish improperly handles http parameters
In Eclipse Glassfish versions before 7.0.17, the Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is `/management/domain`. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-9329US | medium6.1 | — | ||
In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/d… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/eclipse-ee4j/glassfishPACKAGE
- https://github.com/eclipse-ee4j/glassfish/commit/6ca35eee2ba90a8108984b27bec33f9cc50cd83bWEB
- https://github.com/eclipse-ee4j/glassfish/pull/25106WEB
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/232WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-9329ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan