Vulnerability · Published Sep 11, 2024 · Assigned by eclipse
CVE-2024-8646Eclipse Glassfish: URL redirection vulnerability to untrusted sites
Medium 6.1
In plain English
A medium-severity open redirect in Eclipse Glassfish from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed. This vulnerability is caused by the vulnerability (CVE-2023-41080) in the Apache code included in GlassFish. This vulnerability only affects applications that are explicitly deployed to the root context ('/').
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.glassfish.main.web:web-core | 7.0.10 | GHSA-7gq2-vwq9-w8vw |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse Glassfish | 5.1.0 – before 7.0.10 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N