Read the docs
TI-2025-13101 Aliases CVE-2025-14340GHSA-rgjw-pqcr-56gf

Admin Account Takeover via malicious URL payload

Priority LOW 36CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0103 63rd percentileScored 2026-11-07
Fix Fixed Payara Server (Payara Platform): 4.1.2.191.54, 5.83.0, 6.34.0 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Payara PlatformPayara Server4.1.153.1 – 4.1.2.191.53; 5.20.0 – 5.82.0; 6.0.0 – 6.33.0; 7.2024.1.Alpha1 – 7.2025.2; 6.2022.1 – 6.2025.11; 5.2020.2 – 5.2022.5; 5.181 – 5.201.24.1.2.191.54, 5.83.0, 6.34.0, 7.2026.1Patch availableCNA
  • Payara Server VendorPayara Platform Affected 4.1.153.1 – 4.1.2.191.53; 5.20.0 – 5.82.0; 6.0.0 – 6.33.0; 7.2024.1.Alpha1 – 7.2025.2; 6.2022.1 – 6.2025.11; 5.2020.2 – 5.2022.5; 5.181 – 5.201.2 Fixed in 4.1.2.191.54, 5.83.0, 6.34.0, 7.2026.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:payara:payara:*:*:*:*:*:*:*:*——Payara Platform

Remediation

  • Fix · CNA Payara Server (Payara Platform) Fixed in 4.1.2.191.54, 5.83.0, 6.34.0, 7.2026.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-14340
  2. 2026-10-03 Alias added: GHSA-rgjw-pqcr-56gf

References

Other 1

  • TI-2022-22205 Payara before 2022-11-04, when deployed to the root context, allows attackers to visit… CVSS 3.1HIGH 7.5
  • TI-2021-18200 Payara Micro Community 5.2021.6 and below allows Directory Traversal. CVSS 3.1HIGH 7.5
  • TI-2023-13003 A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191… CVSS 3.1CRITICAL 9.8
  • TI-2024-07614 Payload Injection Attack via Management REST interface CVSS 4.0HIGH 8.7
  • TI-2022-17489 Payara through 5.2022.2 allows directory traversal without authentication. CVSS 3.1HIGH 7.5
  • TI-2026-11048 Cross-site request forgery in Payara Server CVSS 4.0HIGH 7.3
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences