Eclipse GlassFish is vulnerable to Stored XSS attacks through configuration file modifications

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-10031 · ADVISORY
• eclipse-ee4j/glassfish · PACKAGE
• gitlab.eclipse.org/security/cve-assignement/-/issues/41 · WEB
• gitlab.eclipse.org/security/vulnerability-reports/-/issues/229 · WEB

More vulnerabilities in org.glassfish.main.admingui:console-common

• CVE-2026-2586CRITICAL 9.1An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the p…
• CVE-2024-9408CRITICAL 9.8In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints.
• CVE-2024-9343MEDIUM 6.1In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.
• CVE-2024-9342CRITICAL 9.8In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of fa…
• CVE-2024-10029MEDIUM 6.1In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console.