Vulnerability · Published Sep 11, 2024 · Assigned by Payara
CVE-2024-8097Sensitive information exposure when the org.glassfish.admingui LOGGER is set to FINEST level
Medium 6.7
In plain English
A medium-severity information exposure in Payara Server from Payara Platform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Official description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Payara Platform Payara Server (Logging modules) allows Sensitive credentials posted in plain-text on the server log.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.20.0 before 5.67.0, from 5.2020.2 before 5.2022.5, from 4.1.2.191.0 before 4.1.2.191.50.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Payara Platform | Payara Server | 6.0.0 – before 6.18.06.2022.1 – before 6.2024.95.20.0 – before 5.67.05.2020.2 – before 5.2022.54.1.2.191.0 – before 4.1.2.191.50 |
Weakness: CWE-200 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N