by Kastro
Paper/Archive/CVE-2024-9342

CVE-2024-9342

Eclipse Foundation Eclipse Glassfish — In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of…

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 41.2.412 × 208.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/security-guide.html#brute-force-attack-protection .

Affected

ProductAffectedFixed inSource
Eclipse Glassfish5.1.0–CNA
Eclipse Glassfish6.0.0 – 6.2.5–CNA
Eclipse Glassfish7.0.0 – 7.0.25–CNA
Eclipse Glassfish7.1.0–CNA
Eclipse Glassfish8.0.0 – < 8.0.38.0.3CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
eclipse (CNA)6.3CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgitlab.eclipse.org/security/cve-assignement/-/issues/33