PT-2024-38258 · Payara · Payara Server

Claudia Bartolini + 3 · Published 2024-09-11 · Updated 2024-09-13 · CVE-2024-7312

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:L/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Payara Server versions 4.1.2.191.0 through 4.1.2.191.50 Payara Server versions 5.20.0 through 5.67.0 Payara Server versions 5.2020.2 through 5.2022.5 Payara Server versions 6.0.0 through 6.18.0 Payara Server versions 6.2022.1 through 6.2024.9

Description The issue affects the Payara Platform Payara Server, specifically the REST Management Interface modules, allowing session hijacking due to a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.

Recommendations For Payara Server versions 4.1.2.191.0 through 4.1.2.191.50, update to version 4.1.2.191.50 or later. For Payara Server versions 5.20.0 through 5.67.0, update to version 5.67.0 or later. For Payara Server versions 5.2020.2 through 5.2022.5, update to version 5.2022.5 or later. For Payara Server versions 6.0.0 through 6.18.0, update to version 6.18.0 or later. For Payara Server versions 6.2022.1 through 6.2024.9, update to version 6.2024.9 or later.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-7312

Affected Products

Payara Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-7312 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7312 · Vendor Advisory
• https://t.me/cvenotify/94267 · Telegram Post
• https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.18.0.html · Note
• https://t.me/cvedetector/5367 · Telegram Post
• https://docs.payara.fish/enterprise/docs/5.67.0/Release%20Notes/Release%20Notes%205.67.0.html · Note
• https://twitter.com/CVEnew/status/1833923758316536291 · Twitter Post