Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-9329

Good to know:

icon
icon

Date: September 30, 2024

In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

Language: Java

Severity Score

Related Resources (7)

https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/232
https://github.com/eclipse-ee4j/glassfish/pull/25106
https://github.com/eclipse-ee4j/glassfish/commit/6ca35eee2ba90a8108984b27bec33f9cc50cd83b
https://github.com/eclipse-ee4j/glassfish
https://www.gruppotim.it/it/footer/red-team.html
https://nvd.nist.gov/vuln/detail/CVE-2024-9329
https://www.mend.io/vulnerability-database/CVE-2024-9329

Severity Score

Weakness Type (CWE)

URL Redirection to Untrusted Site ('Open Redirect')

CWE-601

Improper Handling of Parameters

CWE-233

Top Fix

icon

Upgrade Version

Upgrade to version org.glassfish.main.admin:rest-service:7.0.17

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us