Debora Esposito

Eclipse GlassFish الإصدار 7.0.15 معرض لهجمات البرمجة النصية عبر المواقع (Cross-site scripting) المخزنة في وحدة التحكم الإدارية.

يُعتبر Eclipse GlassFish عرضة لهجمات القوة الغاشمة عند تسجيل الدخول بسبب عدم وجود قيود على عدد محاولات تسجيل الدخول الفاشلة.

يُعتبر Eclipse GlassFish الإصدار 7.0.15 عرضة لهجمات البرمجة النصية عبر المواقع (Cross-site scripting) المخزنة في وحدة التحكم الإدارية.

يُعتبر Eclipse GlassFish الإصدار 7.0.15 عرضة لهجمات البرمجة النصية عبر المواقع (Cross-site Scripting) المنعكسة في وحدة التحكم الإدارية.

يُعتبر Eclipse GlassFish الإصدار 7.0.15 عرضة لهجمات «التنفيذ البرمجي عبر المواقع المخزنة» (XSS). ويمكن تنفيذ هذه الهجمات عن طريق تعديل ملف التكوين في نظام التشغيل الأساسي.

Name of the Vulnerable Software and Affected Versions: Payara Server versions 4.1.2.191.1 through 4.1.2.191.50 Payara Server versions 5.20.0 through 5.67.0 Payara Server versions 6.0.0 through 6.18.0 Payara Server versions 6.2022.1 through 6.2024.9 Description: The issue affects the Payara Server, specifically the Admin Console modules, due to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Remote Code Inclusion. Recommendations: For Payara Server versions 4.1.2.191.1 through 4.1.2.191.50, update to version 4.1.2.191.51 or later. For Payara Server versions 5.20.0 through 5.67.0, update to version 5.68.0 or later. For Payara Server versions 6.0.0 through 6.18.0, update to version 6.19.0 or later. For Payara Server versions 6.2022.1 through 6.2024.9, update to version 6.2024.10 or later.

The Host HTTP parameter could cause the web application to redirect to the specified URL when the requested endpoint is "/management/domain". By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

Name of the Vulnerable Software and Affected Versions: Payara Server versions 4.1.2.191.0 through 4.1.2.191.50 Payara Server versions 5.20.0 through 5.67.0 Payara Server versions 5.2020.2 through 5.2022.5 Payara Server versions 6.0.0 through 6.18.0 Payara Server versions 6.2022.1 through 6.2024.9 Description: The issue affects the Payara Platform Payara Server, specifically the logging modules, allowing sensitive credentials to be posted in plain text on the server log. This exposes sensitive information to unauthorized actors. Recommendations: For Payara Server versions 4.1.2.191.0 through 4.1.2.191.50, update to version 4.1.2.191.50 or later. For Payara Server versions 5.20.0 through 5.67.0, update to version 5.67.0 or later. For Payara Server versions 5.2020.2 through 5.2022.5, update to version 5.2022.5 or later. For Payara Server versions 6.0.0 through 6.18.0, update to version 6.18.0 or later. For Payara Server versions 6.2022.1 through 6.2024.9, update to version 6.2024.9 or later.

The issue affects the Payara Platform Payara Server, specifically the REST Management Interface modules, allowing session hijacking due to a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.