CVE-2024-9329

MEDIUM EPSS 47.0%
Published Sep 30, 20241y ago · Modified Jun 17, 20262w ago
6.9 CVSS 4.0
Medium
Find Similar
Published Sep 30, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

CVSS Details

Base Score
6.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
47.0% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-233
CWE-601

Affected Products 1

VendorProductVersionRange
eclipseglassfish* <7.0.17

References 3

  • github.com https://github.com/eclipse-ee4j/glassfish/pull/25106
    ExploitPatch
  • gitlab.eclipse.org https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/232
    ExploitVendor Advisory
  • gruppotim.it https://www.gruppotim.it/it/footer/red-team.html

Remediation

  • github.com https://github.com/eclipse-ee4j/glassfish/pull/25106
    ExploitPatch