In Eclipse GlassFish version 7.0.15, it is possible to perform Reflected Cross-Site Scripting attacks through the Administration Console.
References:GSA_kwCzR0hTQS12cXJtLTgzZzYtcGZ2NM4ABKND
Eclipse GlassFish is vulnerable to Reflected XSS attacks through its Administration Console
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| maven:org.glassfish.main.admingui:console-cluster-plugin | <= 7.0.25 | No known fixed version | |
Affected Version RangesAll affected versions5.1.0, 6.0.0, 6.1.0, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.12, 7.0.13, 7.0.14, 7.0.15, 7.0.16, 7.0.17, 7.0.18, 7.0.19, 7.0.20, 7.0.21, 7.0.22, 7.0.23, 7.0.24, 7.0.25 |
|||
| maven:org.glassfish.main.admingui:console-common | <= 7.0.25 | No known fixed version | |
Affected Version RangesAll affected versions5.1.0, 6.0.0, 6.1.0, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.12, 7.0.13, 7.0.14, 7.0.15, 7.0.16, 7.0.17, 7.0.18, 7.0.19, 7.0.20, 7.0.21, 7.0.22, 7.0.23, 7.0.24, 7.0.25 |
|||