PT-2024-39578 · Eclipse · Eclipse Glassfish

Andrea Carlo Maria Dattola + 4 · Published 2024-09-30 · Updated 2024-10-07 · CVE-2024-9329

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Eclipse Glassfish versions prior to 7.0.17

Description The Host HTTP parameter could cause the web application to redirect to the specified URL when the requested endpoint is "/management/domain". By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

Recommendations For Eclipse Glassfish versions prior to 7.0.17, as a temporary workaround, consider restricting access to the "/management/domain" endpoint until a patch is available. Avoid using the Host HTTP parameter in the affected endpoint to minimize the risk of exploitation. Update to version 7.0.17 or later to resolve the issue.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

CWE-233

Related Identifiers

CVE-2024-9329

GHSA-JQ3F-MFMG-747X

Affected Products

Eclipse Glassfish

References · 12

• 🔥 https://github.com/eclipse-ee4j/glassfish/pull/25106 · Exploit
• 🔥 https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/232 · Exploit
• https://osv.dev/vulnerability/GHSA-jq3f-mfmg-747x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-9329 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9329 · Security Note
• https://github.com/eclipse-ee4j/glassfish · Note
• https://github.com/eclipse-ee4j/glassfish/commit/6ca35eee2ba90a8108984b27bec33f9cc50cd83b · Note
• https://t.me/cvenotify/97292 · Telegram Post
• https://gruppotim.it/it/footer/red-team.html · Note
• https://t.me/cvedetector/6639 · Telegram Post
• https://twitter.com/CVEnew/status/1840655488620298314 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1840716015589572947 · Twitter Post