PT-2024-7963 · Apache+1 · Apache+1

Hiroki Sawamura · Published 2024-09-11 · Updated 2024-09-18 · CVE-2024-8646

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Glassfish versions prior to 7.0.10

Description A URL redirection issue to untrusted sites exists, caused by a vulnerability in the included Apache code. This issue only affects applications explicitly deployed to the root context ('/'). The vulnerability can be exploited to redirect users to an arbitrary URL address.

Recommendations For Eclipse Glassfish versions prior to 7.0.10, update to version 7.0.10 or later to resolve the issue. As a temporary workaround, consider restricting access to applications deployed to the root context ('/') until the update is applied.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2024-09476

CVE-2024-8646

GHSA-7GQ2-VWQ9-W8VW

Affected Products

Apache

Eclipse Glassfish

References · 13

• https://github.com/eclipse-ee4j/glassfish/pull/24655 · Patch
• https://gitlab.eclipse.org/security/cve-assignement/-/issues/34 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8646 · Security Note
• https://bdu.fstec.ru/vul/2024-09476 · Security Note
• https://osv.dev/vulnerability/GHSA-7gq2-vwq9-w8vw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8646 · Vendor Advisory
• https://github.com/eclipse-ee4j/glassfish · Note
• https://github.com/eclipse-ee4j/glassfish/commit/06b80012761d07f6e40e40aa6b0133465b0bd145 · Note
• https://twitter.com/CVEnew/status/1833865960606023778 · Twitter Post
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/163 · Note
• https://t.me/cvedetector/5355 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1833916345370431794 · Twitter Post
• https://glassfish.org/download · Note