| Package | Affected versions | Patched versions |
|---|---|---|
| org.glassfish.main.admin:rest-service | < 7.0.17 | 7.0.17 |
| glassfish | < 7.0.17 | 7.0.17 |
In Eclipse Glassfish versions before 7.0.17, the Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is /management/domain. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free