Eclipse GlassFish is vulnerable to Stored XSS attacks through configuration file modifications
Date: 2025-07
Affected: maven/org.glassfish.main.admingui:console-common
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-10031
CWE: CWE-79

In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating system.


Mitigations:

Architectural layers (MAESTRO):