CVE-2024-8097: Sensitive information exposure when the org.glassfish.admingui LOGGER is set to FINEST level
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Payara Platform Payara Server (Logging modules) allows Sensitive credentials posted in plain-text on the server log.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.20.0 before 5.67.0, from 5.2020.2 before 5.2022.5, from 4.1.2.191.0 before 4.1.2.191.50.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8097?
CVE-2024-8097 is classified as a vulnerability that exposes sensitive information due to plain-text logging of credentials.
How do I fix CVE-2024-8097?
To fix CVE-2024-8097, upgrade Payara Server to versions 6.18.0 or 6.2024.9 or later.
What versions of Payara Server are affected by CVE-2024-8097?
CVE-2024-8097 affects Payara Server versions from 6.0.0 before 6.18.0, 6.2022.1 before 6.2024.9, and several earlier versions.
What type of information is exposed in CVE-2024-8097?
CVE-2024-8097 exposes sensitive credentials that are logged in plain-text on the server.
Is CVE-2024-8097 related to any specific logging modules?
Yes, CVE-2024-8097 specifically involves the logging modules within Payara Platform's Payara Server.