Eclipse Glassfish improperly handles http parameters
Date: 2024-09
Affected: maven/org.glassfish.main.admin:rest-service
Attack vector: phishing
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-9329
CWE: CWE-233
CWE-601
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

In Eclipse Glassfish versions before 7.0.17, the Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is `/management/domain`. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.


Mitigations:

Architectural layers (MAESTRO):