CVE-2024-9329 Glassfish redirect to untrusted site
Attackers can redirect users to malicious sites via the Host header, enabling phishing attacks and credential theft in Eclipse Glassfish.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-9329?
CVE-2024-9329 is a medium-severity vulnerability in Eclipse Foundation Glassfish, published on 30 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
Which versions are affected by CVE-2024-9329?
2 open source packages ship an affected version, including org.glassfish.main.admin:rest-service. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.glassfish.main.admin:rest-service Maven | All versions | 7.0.17 |
org.glassfish.main.admin:rest-service Maven | All versions | 7.0.17 |
Products include Eclipse Glassfish.
How do I fix CVE-2024-9329?
Upgrade org.glassfish.main.admin:rest-service to 7.0.17 or later.
Is CVE-2024-9329 being exploited?
There is no known exploitation of CVE-2024-9329 in the wild and no public exploit code.
Other vulnerabilities in Eclipse Foundation Glassfish
- CVE-2026-12605 Server-side request forgery in Eclipse GlassFish
- CVE-2026-2587 GlassFish's gadget handler is vulnerable to RCE
- CVE-2026-2586 GlassFish's Administration Console is Vulnerable to RCE
- CVE-2024-9408 Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints
- CVE-2023-5763 Glassfish remote code execution
Sources
Also known as GHSA-jq3f-mfmg-747x.