Medium severity · published Sep 30, 2024
CVE-2024-9329
Glassfish redirect to untrusted site
6.1
CVSS
0.7%
EPSS
No
On KEV
Description
In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
Glassfish · Eclipse Foundation
5.1.0 through 7.0.16 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9329
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9329
Exploit
https://github.com/eclipse-ee4j/glassfish/pull/25106
Exploit
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/232
www.gruppotim.it
https://www.gruppotim.it/it/footer/red-team.html
More from Glassfish
9.8
CVE-2023-5763
Glassfish remote code execution