Eclipse Glassfish Phishing Vulnerability
CVE-2024-9329

6.1MEDIUM

Key Information:

Vendor: Eclipse Foundation
Status: Glassfish
Vendor: CVE Published:; 30 September 2024

🔔 Create Eclipse Foundation Vulnerability Alert

What is CVE-2024-9329?

In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

Affected Version(s)

Glassfish 5.1.0 <= 7.0.16

References

https://github.com/eclipse-ee4j/glassfish/pull/25106

patch

https://gitlab.eclipse.org/security/vulnerability-reports...

issue-tracking

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 30, 2024
Vulnerability Reserved
Sep 29, 2024

Credit

Marco Ventura (redteam https://www.gruppotim.it/it/footer/red-team.html)

Claudia Bartolini (redteam https://www.gruppotim.it/it/footer/red-team.html)

Andrea Carlo Maria Dattola (redteam https://www.gruppotim.it/it/footer/red-team.html)

Debora Esposito (redteam https://www.gruppotim.it/it/footer/red-team.html)

Massimiliano Brolli (redteam https://www.gruppotim.it/it/footer/red-team.html)