CVE-2024-9329: eclipse foundation glassfish Improper Handling of Parameters
Vulnerability summary
CVE-2024-9329 is a medium (CVSS 6.9) Improper Handling of Parameters vulnerability in eclipse foundation glassfish. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 52.9% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 30-09-2024PublishedVulnerability first disclosed.
- 07-10-2024Last modifiedVulnerability information updated.
Description
In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
CVSS metrics
5 scores · 3 sources · 2 versions- OSV · MavenEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.72%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
0.00 pp
From 0.72% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundGlassfish
Maturity: poc
Exploit Reference (gitlab.eclipse.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-233Improper Handling of ParametersThe product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.
- CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Affected systems
Eclipse1 product
- glassfish< 7.0.17
Eclipse foundation1 product
- glassfish≥ 5.1.0, ≤ 7.0.16
Org.glassfish.main.admin1 product
- rest-service< 7.0.17
3 vendors · 3 products
References
6 links- gitlab.eclipse.org/security/vulnerability-reports/-/issues/232Issue TrackingWEBExploitVendor Advisory
