Vulnerability · Published Oct 8, 2024 · Assigned by Payara
CVE-2024-8215Payload Injection Attack via Management REST interface
High 8.7
In plain English
A high-severity cross-site scripting in Payara Server from Payara Platform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).
Official description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Payara Platform Payara Server (Admin Console modules) allows Remote Code Inclusion.This issue affects Payara Server: from 5.20.0 before 5.68.0, from 6.0.0 before 6.19.0, from 6.2022.1 before 6.2024.10, from 4.1.2.191.1 before 4.1.2.191.51.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Payara Platform | Payara Server | 5.20.0 – before 5.68.06.0.0 – before 6.19.06.2022.1 – before 6.2024.104.1.2.191.1 – before 4.1.2.191.51 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.19.0.html release-notes
- https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%206.2024.10.html release-notes
- https://docs.payara.fish/enterprise/docs/5.68.0/Release%20Notes/Release%20Notes%205.68.0.html release-notes