Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-9408 · ADVISORY
• eclipse-ee4j/glassfish · PACKAGE
• gitlab.eclipse.org/security/cve-assignement/-/issues/38 · WEB
• gitlab.eclipse.org/security/vulnerability-reports/-/issues/239 · WEB

org.glassfish.main.admingui:console-common のその他の脆弱性

• CVE-2026-2586緊急 9.1An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the p…
• CVE-2024-9343中 6.1In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.
• CVE-2024-9342緊急 9.8In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of fa…
• CVE-2024-10031中 5.4In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the un…
• CVE-2024-10029中 6.1In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console.