medium5.3
CVE-2024-9329
Eclipse Glassfish improperly handles http parameters
Impact
In Eclipse Glassfish versions before 7.0.17, the Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is `/management/domain`. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.glassfish.main.admin:rest-service | < 7.0.17 | 7.0.17 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Eclipse | Glassfish | before 7.0.17 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/eclipse-ee4j/glassfish/pull/25106
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/232
- https://www.gruppotim.it/it/footer/red-team.html
- https://github.com/advisories/GHSA-jq3f-mfmg-747x
- https://nvd.nist.gov/vuln/detail/CVE-2024-9329
- https://github.com/eclipse-ee4j/glassfish/commit/6ca35eee2ba90a8108984b27bec33f9cc50cd83b