Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints

CRITICAL 9.8CVE-2024-9408 · GHSA-f7h5-c625-3795 · Published 16/07/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
org.glassfish.main.admingui:console-common Maven	`≤ 6.2.5`	No fix yet
glassfish eclipse	`= 6.2.5`	No fix yet

Description

In Eclipse GlassFish version 6.2.5, it is possible to perform a Server Side Request Forgery attack using specific endpoints.

NVD description

In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.