CVE-2024-7312

published 2024-09-11

CVE-2024-7312: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session…

Priority P4 27 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session Hijacking.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.2020.2 before 5.2022.5, from 5.20.0 before 5.67.0, from 4.1.2.191.0 before 4.1.2.191.50.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
payara	payara	>= 4.1.2.191.0 < 4.1.2.191.50	4.1.2.191.50
payara	payara	>= 5.20.0 < 5.67.0	5.67.0
payara	payara	>= 5.2020.2 < 5.2022.5	5.2022.5
payara	payara	>= 6.0.0 < 6.18.0	6.18.0
payara	payara	>= 6.2022.1 < 6.2024.9	6.2024.9
payara_platform	payara_server	>= 4.1.2.191.0 < 4.1.2.191.50	4.1.2.191.50
payara_platform	payara_server	>= 5.20.0 < 5.67.0	5.67.0
payara_platform	payara_server	>= 5.2020.2 < 5.2022.5	5.2022.5
payara_platform	payara_server	>= 6.0.0 < 6.18.0	6.18.0
payara_platform	payara_server	>= 6.2022.1 < 6.2024.9	6.2024.9

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd v4.0 7.0 HIGH CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vendor_redhat 7.0 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-601