Sensitive information exposure when the org.glassfish.admingui LOGGER is set to FINEST level
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Payara Platform Payara Server (Logging modules) allows Sensitive credentials posted in plain-text on the server log.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.20.0 before 5.67.0, from 5.2020.2 before 5.2022.5, from 4.1.2.191.0 before 4.1.2.191.50.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Payara Platform | Payara Server | 6.0.0 to before 6.18.0; 6.2022.1 to before 6.2024.9; 5.20.0 to before 5.67.0; 5.2020.2 to before 5.2022.5; 4.1.2.191.0 to before 4.1.2.191.50 | 6.18.0, 6.2024.9, 5.67.0, 5.2022.5, 4.1.2.191.50 | Patch available | CNA |
- Payara Server VendorPayara Platform Affected 6.0.0 to before 6.18.0; 6.2022.1 to before 6.2024.9; 5.20.0 to before 5.67.0; 5.2020.2 to before 5.2022.5; 4.1.2.191.0 to before 4.1.2.191.50 Fixed in 6.18.0, 6.2024.9, 5.67.0, 5.2022.5, 4.1.2.191.50 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:payara:payara:*:*:*:*:*:*:*:* | — | — | Payara Platform |
- cpe:2.3:a:payara:payara:*:*:*:*:*:*:*:* Versions — — ·Payara Platform
Remediation
- Fix · CNA Payara Server (Payara Platform) Fixed in 6.18.0, 6.2024.9, 5.67.0, 5.2022.5, 4.1.2.191.50
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Payara Server 4.1.2.191.50, 5.2022.5 and 3 more versions
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2024-06773 REST Interface Link Redirection via Host parameterPriority LOW 32
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat JBoss Data Grid 7
Timeline
- 2026-10-02 Threatist record created from CVE-2024-8097
- 2026-10-03 Alias added: GHSA-w9q2-g4fg-c4pw
References
More Payara Platform vulnerabilities
- TI-2022-22205 Payara before 2022-11-04, when deployed to the root context, allows attackers to visit… CVSS 3.1HIGH 7.5
- TI-2021-18200 Payara Micro Community 5.2021.6 and below allows Directory Traversal. CVSS 3.1HIGH 7.5
- TI-2023-13003 A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191… CVSS 3.1CRITICAL 9.8
- TI-2024-07614 Payload Injection Attack via Management REST interface CVSS 4.0HIGH 8.7
- TI-2025-13101 Admin Account Takeover via malicious URL payload CVSS 4.0HIGH 7.3
- TI-2022-17489 Payara through 5.2022.2 allows directory traversal without authentication. CVSS 3.1HIGH 7.5
Sources
- CVE-2024-8097 · CVE Program
- CVE-2024-8097 · NVD
- FIRST EPSS
- GHSA-w9q2-g4fg-c4pw · GitHub Advisory Database · CC BY 4.0
- CVE-2024-8097 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences