Missing brute-force protection in Eclipse Glassfish
Priority LOW 29CWE-307Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-307.
Summary
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/security-guide.html#brute-force-attack-protection .
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00477 41st percentileScored 2026-11-07
Fix Fixed Eclipse Glassfish (Eclipse Foundation): 8.0.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Glassfish | 5.1.0; 6.0.0 – 6.2.5; 7.0.0 – 7.0.25; 7.1.0; 8.0.0 to before 8.0.3 | 8.0.3 | Patch available | CNA |
| — | org.glassfish.main.admingui:console-common (Maven) | up to 7.0.25 | — | No fix listed | GHSA-99f7-hp6j-v6q4 |
- Eclipse Glassfish VendorEclipse Foundation Affected 5.1.0; 6.0.0 – 6.2.5; 7.0.0 – 7.0.25; 7.1.0; 8.0.0 to before 8.0.3 Fixed in 8.0.3 Patch available CNA
- org.glassfish.main.admingui:console-common (Maven) Vendor— Affected up to 7.0.25 Fixed in — No fix listed GHSA-99f7-hp6j-v6q4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:glassfish:7.0.16:*:*:*:*:*:*:* | 7.0.16 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:glassfish:7.0.16:*:*:*:*:*:*:* Versions 7.0.16 Vulnerable ·Eclipse Foundation
Remediation
- Fix · CNA Eclipse Glassfish (Eclipse Foundation) Fixed in 8.0.3
Timeline
- 2026-10-02 Threatist record created from CVE-2024-9342
- 2026-10-03 Alias added: GHSA-99f7-hp6j-v6q4
References
More Eclipse Foundation Glassfish vulnerabilities
- TI-2026-02210 Expression language injection in Eclipse Glassfish CVSS 3.1CRITICAL 9.6
- TI-2023-05301 Glassfish remote code execution CVSS 3.1CRITICAL 9.8
- TI-2026-10805 Server-side request forgery in Eclipse GlassFish CVSS 3.1CRITICAL 9.6
- TI-2026-02209 Expression language injection in Eclipse Glassfish CVSS 3.1CRITICAL 9.1
- TI-2024-08729 Server-side request forgery in Eclipse Glassfish CVSS 4.0HIGH 8.9
- TI-2024-08661 Glassfish redirect to untrusted site CVSS 4.0MEDIUM 6.9
Sources
- CVE-2024-9342 · CVE Program
- CVE-2024-9342 · NVD
- FIRST EPSS
- GHSA-99f7-hp6j-v6q4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences