GHSA-99f7-hp6j-v6q4

Eclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-9342

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.glassfish.main.admingui:console-common	<= 7.0.25	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

In Eclipse GlassFish version 7.0.16 or earlier, it is possible to perform login brute force attacks as there is no limitation on the number of failed login attempts.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-9342 advisory
https://github.com/eclipse-ee4j/glassfish package
https://gitlab.eclipse.org/security/cve-assignement/-/issues/33 web
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/231 web