CVE-2024-10031: Eclipse GlassFish Console-Common Vulnerable to Stored XSS Attacks
Summary
CVE-2024-10031: Eclipse GlassFish is vulnerable to Stored XSS attacks through configuration file modifications. Affects org.glassfish.main.admingui:console-common versions < 7.0.25. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse GlassFish is an open-source application server that provides a runtime environment for Java EE applications. The 'console-common' package is a critical component that facilitates the management and configuration of GlassFish servers through a web-based interface. This package is widely used for its ease of use and robust features, but it is susceptible to security vulnerabilities, including the one detailed here.
Vulnerability Detail
In Eclipse GlassFish version 7.0.15, a vulnerability exists that allows for Stored Cross-site Scripting (XSS) attacks. This vulnerability arises from improper handling of user input in the configuration files, which can be modified by an attacker with access to the underlying operating system. If exploited, this vulnerability could allow attackers to execute arbitrary scripts in the context of the user's browser, potentially leading to data theft, session hijacking, or other malicious actions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the configuration files and ensure that only trusted administrators have the ability to modify them. Additionally, implementing input validation and sanitization measures can help mitigate the risk of XSS attacks until a patch is applied.
Conclusion
The vulnerability identified as CVE-2024-10031 in Eclipse GlassFish's console-common package poses a significant risk due to its potential for Stored XSS attacks. Users are strongly advised to update to the latest version to mitigate this risk. Implementing additional security measures can help protect against exploitation until a patch is applied.
See every vulnerability recorded for org.glassfish.main.admingui:console-common →
FAQ
The vulnerability is a Stored Cross-site Scripting (XSS) issue that allows attackers to inject malicious scripts into the application.
Eclipse GlassFish versions from 0 up to 7.0.25 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your pom.xml file, Vulert can provide real-time alerts about vulnerabilities.
If an immediate update is not possible, implement strict access controls to configuration files and validate user inputs to reduce the risk of exploitation.
More details can be found in the official advisory on GitHub or by visiting the NVD database.
Related vulnerabilities
Recent vulnerabilities recorded for org.glassfish.main.admingui:console-common.
