Glassfish redirect to untrusted site

6.9 CVSS

Vulnerability Description

In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-9329

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Marco Ventura (redteam https://www.gruppotim.it/it/footer/red-team.html)
Claudia Bartolini (redteam https://www.gruppotim.it/it/footer/red-team.html)
Andrea Carlo Maria Dattola (redteam https://www.gruppotim.it/it/footer/red-team.html)
Debora Esposito (redteam https://www.gruppotim.it/it/footer/red-team.html)
Massimiliano Brolli (redteam https://www.gruppotim.it/it/footer/red-team.html)