Eclipse GlassFish vulnerabilities
6 known vulnerabilities in Eclipse GlassFish from Eclipse Foundation. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.6 Critical severity
Eclipse GlassFish: Server-Side Request Forgery
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console -\> full unauthenticated takeover of Eclipse GlassFi
- 9.6 Critical severity
Eclipse Glassfish: Improper Neutralization of Special Elements used in an Expression Language Statement
A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression
- 9.1 Critical severity
Eclipse Glassfish: Improper Control of Generation of Code
An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of th
- 9.8 Critical severity
Eclipse OpenMQ: Improper Limitation of a Pathname to a Restricted Directory
An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could
- 9.8 Critical severity
Eclipse Glassfish: Improper Restriction of Excessive Authentication Attempts
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/se
- 7.5 High severity
Eclipse GlassFish: Improper Limitation of a Pathname to a Restricted Directory
In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such a