Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-9408 · ADVISORY
• eclipse-ee4j/glassfish · PACKAGE
• gitlab.eclipse.org/security/cve-assignement/-/issues/38 · WEB
• gitlab.eclipse.org/security/vulnerability-reports/-/issues/239 · WEB

Weitere Schwachstellen in org.glassfish.main.admingui:console-common

• CVE-2026-2586KRITISCH 9.1An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the p…
• CVE-2024-9343MITTEL 6.1In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.
• CVE-2024-9342KRITISCH 9.8In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of fa…
• CVE-2024-10031MITTEL 5.4In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the un…
• CVE-2024-10029MITTEL 6.1In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console.