CVE-2024-8646 — Open Redirect in Foundation Eclipse Glassfish

CWE-601 — Open Redirect4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.8%
top 26.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Eclipse Foundation Eclipse GlassfishEclipse Glassfish
Timeline
PublishedSep 11

Description

In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed. This vulnerability is caused by the vulnerability (CVE-2023-41080) in the Apache code included in GlassFish. This vulnerability only affects applications that are explicitly deployed to the root context ('/').

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDeclipse/glassfish5.1.0 — 7.0.10
▶CVEListV5eclipse_foundation/eclipse_glassfish5.1.0 — 7.0.10

Patches

Patch: github.com ↗

🔴Vulnerability Details

3
OSV
Eclipse Glassfish URL redirection vulnerability↗2024-09-11
▶
GHSA
Eclipse Glassfish URL redirection vulnerability↗2024-09-11
▶
CVEList
Eclipse Glassfish: URL redirection vulnerability to untrusted sites↗2024-09-11
▶
CVE-2024-8646 — Open Redirect | cvebase