CVE-2024-9343: Stored XSS Vulnerability in org.glassfish.main.admingui:console-common
Summary
CVE-2024-9343: Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console. Affects org.glassfish.main.admingui:console-common versions < 7.0.25. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.glassfish.main.admingui:console-common package is a component of the Eclipse GlassFish server, which provides a robust platform for developing and deploying Java EE applications. This package is integral to the Administration Console, allowing users to manage server configurations and monitor application performance. However, it has been identified to have a vulnerability that could lead to security risks if not addressed promptly.
Vulnerability Detail
In Eclipse GlassFish version 7.0.15, a Stored Cross-Site Scripting (XSS) vulnerability exists within the Administration Console. This vulnerability allows attackers to inject malicious scripts into the console, which can then be executed in the context of other users' browsers. The origin of this issue lies in insufficient input validation and sanitization, potentially leading to unauthorized actions and data exposure. If exploited, this vulnerability could compromise user sessions and sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate update is not feasible, consider restricting access to the Administration Console to trusted users only, and implement web application firewalls to filter out malicious requests. Regularly monitor logs for unusual activities that may indicate an attempted exploit.
Conclusion
The CVE-2024-9343 vulnerability in the org.glassfish.main.admingui:console-common package poses a significant risk through Stored XSS attacks. It is crucial for users to update to the latest version to protect their applications and data. Implementing additional security measures can help mitigate risks until an update can be applied.
See every vulnerability recorded for org.glassfish.main.admingui:console-common →
FAQ
The impact includes potential unauthorized access to user sessions and exposure of sensitive information through stored XSS attacks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your pom.xml file, you can check for vulnerabilities without needing to install any software.
If an immediate update is not possible, restrict access to the Administration Console and implement security measures such as web application firewalls.
Yes, you should upgrade to version 7.0.26 or later to mitigate the vulnerability.
Stored XSS is a type of security vulnerability where an attacker can inject malicious scripts into a web application, which are then stored and executed in the browsers of users accessing the application, potentially leading to data theft or session hijacking.
Related vulnerabilities
Recent vulnerabilities recorded for org.glassfish.main.admingui:console-common.
