CVE-2024-9329 | THREATINT

Description

In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

Reserved 2024-09-29 | Published 2024-09-30 | Updated 2024-10-07 | Assigner eclipse

MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-233 Improper Handling of Parameters

Product status

Default status

unaffected

5.1.0

affected

Credits

Marco Ventura (redteam https://www.gruppotim.it/it/footer/red-team.html) finder

Claudia Bartolini (redteam https://www.gruppotim.it/it/footer/red-team.html) finder

Andrea Carlo Maria Dattola (redteam https://www.gruppotim.it/it/footer/red-team.html) finder

Debora Esposito (redteam https://www.gruppotim.it/it/footer/red-team.html) finder

Massimiliano Brolli (redteam https://www.gruppotim.it/it/footer/red-team.html) finder

References

github.com/eclipse-ee4j/glassfish/pull/25106 patch

gitlab.eclipse.org/...ity/vulnerability-reports/-/issues/232 issue-tracking

cve.org (CVE-2024-9329)

nvd.nist.gov (CVE-2024-9329)

Download JSON