Glassfish vulnerabilities
6 known vulnerabilities in Glassfish from Eclipse Foundation. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.6 Critical severity
Eclipse GlassFish: Server-Side Request Forgery
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console -\> full unauthenticated takeover of Eclipse GlassFi
- 9.6 Critical severity
Eclipse Glassfish: Improper Neutralization of Special Elements used in an Expression Language Statement
A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evaluates user-supplied values within a context where Expression
- 9.1 Critical severity
Eclipse Glassfish: Improper Control of Generation of Code
An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of th
- 9.8 Critical severity
Eclipse Glassfish: Improper Restriction of Excessive Authentication Attempts
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/se
- 9.8 Critical severity
Glassfish: Improper Control of Dynamically-Managed Code Resources
In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners.
- 7.5 High severity
Eclipse GlassFish: Improper Limitation of a Pathname to a Restricted Directory
In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such a