Vulnerability in Eclipse Glassfish Could Lead to Redirect to Untrusted Sites

CVE-2024-8646
6.1MEDIUM

Key Information

Vendor
Eclipse Foundation
Status
Eclipse Glassfish
Vendor
CVE Published:
11 September 2024

Summary

In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed. This vulnerability is caused by the vulnerability (CVE-2023-41080) in the Apache code included in GlassFish. This vulnerability only affects applications that are explicitly deployed to the root context ('/').

Affected Version(s)

Eclipse Glassfish < 7.0.10

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database
.