CVE-2023-41699
Assigner: Payara
Published: 2023-11-15T19:54:23.590Z
State: PUBLISHED
affected: defaultStatus: unaffected
modules: Servlet Implementation
product: Payara Server, Micro and Embedded
vendor: Payara Platform
versions: lessThan: 5.57.0
status: affected
version: 5.0.0
versionType: semver
lessThan: 4.1.2.191.46
status: affected
version: 4.1.2.191
versionType: semver
lessThan: 6.8.0
status: affected
version: 6.0.0
versionType: semver
lessThan: 6.2023.11
status: affected
version: 6.2023.1
versionType: semver
credits: type: reporter
user: 00000000-0000-4000-9000-000000000000
value: Hiroki Sawamura from Fujitsu
datePublic: 2023-11-16T21:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows Redirect Access to Libraries.<p>This issue affects Payara Server, Micro and Embedded: from 5.0.0 before 5.57.0, from 4.1.2.191 before 4.1.2.191.46, from 6.0.0 before 6.8.0, from 6.2023.1 before 6.2023.11.</p>
value: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows Redirect Access to Libraries.This issue affects Payara Server, Micro and Embedded: from 5.0.0 before 5.57.0, from 4.1.2.191 before 4.1.2.191.46, from 6.0.0 before 6.8.0, from 6.2023.1 before 6.2023.11.


impacts: capecId: CAPEC-159
descriptions: value: CAPEC-159 Redirect Access to Libraries
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
type: CWE
source: defect: CVE-2023-41080
discovery: INTERNAL
title: Payara Platform: URL Redirection to untrusted site using FORM authentication
x_generator: engine: Vulnogram 0.1.0-dev