Claudia Bartolini

Eclipse GlassFish version 7.0.15 is susceptible to Reflected Cross-site scripting attacks within the Administration Console.

Eclipse GlassFish version 7.0.15 is susceptible to Stored Cross-site scripting attacks within the Administration Console.

Eclipse GlassFish version 7.0.15 is susceptible to Stored Cross-site Scripting attacks. The attacks can be performed by modifying the configuration file within the underlying operating system.

Eclipse GlassFish version 7.0.15 is susceptible to Stored Cross-site scripting attacks within the Administration Console.

Eclipse GlassFish is susceptible to login brute-force attacks due to the absence of restrictions on the number of failed login attempts.

Name of the Vulnerable Software and Affected Versions: Puppet Enterprise versions 2018.1.8 through 2023.8.3 Puppet Enterprise version 2025.3 Description: A user with specific node group editing permissions and a specially crafted `class parameter` could execute commands as root on the primary host. Recommendations: For Puppet Enterprise versions 2018.1.8 through 2023.8.3, update to version 2023.8.4. For Puppet Enterprise version 2025.3, update to version 2025.4.0.

The issue affects Payara Server, allowing remote code inclusion due to improper neutralization of input during web page generation, also known as cross-site scripting.

A flaw was found in the Wildfly Elytron integration, where the component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame. This makes it more susceptible to brute force attacks via the Command Line Interface (CLI).

A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action.

A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”. This issue can lead to a cross-site scripting (XSS) vulnerability in the management console.

Name of the Vulnerable Software and Affected Versions: Payara Server versions 4.1.2.191.1 through 4.1.2.191.50 Payara Server versions 5.20.0 through 5.67.0 Payara Server versions 6.0.0 through 6.18.0 Payara Server versions 6.2022.1 through 6.2024.9 Description: The issue affects the Payara Server, specifically the Admin Console modules, due to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Remote Code Inclusion. Recommendations: For Payara Server versions 4.1.2.191.1 through 4.1.2.191.50, update to version 4.1.2.191.51 or later. For Payara Server versions 5.20.0 through 5.67.0, update to version 5.68.0 or later. For Payara Server versions 6.0.0 through 6.18.0, update to version 6.19.0 or later. For Payara Server versions 6.2022.1 through 6.2024.9, update to version 6.2024.10 or later.

The Host HTTP parameter could cause the web application to redirect to the specified URL when the requested endpoint is "/management/domain". By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

Name of the Vulnerable Software and Affected Versions: Payara Server versions 4.1.2.191.0 through 4.1.2.191.50 Payara Server versions 5.20.0 through 5.67.0 Payara Server versions 5.2020.2 through 5.2022.5 Payara Server versions 6.0.0 through 6.18.0 Payara Server versions 6.2022.1 through 6.2024.9 Description: The issue affects the Payara Platform Payara Server, specifically the logging modules, allowing sensitive credentials to be posted in plain text on the server log. This exposes sensitive information to unauthorized actors. Recommendations: For Payara Server versions 4.1.2.191.0 through 4.1.2.191.50, update to version 4.1.2.191.50 or later. For Payara Server versions 5.20.0 through 5.67.0, update to version 5.67.0 or later. For Payara Server versions 5.2020.2 through 5.2022.5, update to version 5.2022.5 or later. For Payara Server versions 6.0.0 through 6.18.0, update to version 6.18.0 or later. For Payara Server versions 6.2022.1 through 6.2024.9, update to version 6.2024.9 or later.

The issue affects the Payara Platform Payara Server, specifically the REST Management Interface modules, allowing session hijacking due to a URL Redirection to Untrusted Site ('Open Redirect') vulnerability.