Description (CNA)
In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Eclipse Foundation / Glassfish | affected 5.1.0 through 7.0.16 |
CWE
CWE-233
References
- https://github.com/eclipse-ee4j/glassfish/pull/25106
- https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/232
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.