CVE-2024-9342: Medium severity Eclipse GlassFish vulnerability
In Eclipse GlassFish version 7.0.16 or earlier it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts.
Other sources
In Eclipse GlassFish version 7.0.16 or earlier, it is possible to perform login brute force attacks as there is no limitation on the number of failed login attempts.
— GitHub
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/security-guide.html#brute-force-attack-protection .
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.glassfish.main.admingui:console-commonto a version that resolves this vulnerability.Fixed in 8.0.3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9342?
CVE-2024-9342 has a high severity due to the potential for Login Brute Force attacks.
How do I fix CVE-2024-9342?
To fix CVE-2024-9342, upgrade to Eclipse GlassFish version 7.0.17 or later.
What are the implications of CVE-2024-9342?
CVE-2024-9342 allows attackers to guess user passwords through unlimited failed login attempts.
Which versions of Eclipse GlassFish are affected by CVE-2024-9342?
Eclipse GlassFish versions 7.0.16 and earlier are affected by CVE-2024-9342.
Is there a workaround for CVE-2024-9342?
Implementing a rate limiting mechanism for login attempts can serve as a temporary workaround for CVE-2024-9342.