In Eclipse GlassFish version 7.0.15, it is possible to perform Stored Cross-Site Scripting attacks through the Administration Console.
References:GSA_kwCzR0hTQS1tcXh4LWM0M2gtamo5ds4ABKNG
Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| maven:org.glassfish.main.admingui:console-common | <= 7.0.25 | No known fixed version | |
Affected Version RangesAll affected versions5.1.0, 6.0.0, 6.1.0, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.12, 7.0.13, 7.0.14, 7.0.15, 7.0.16, 7.0.17, 7.0.18, 7.0.19, 7.0.20, 7.0.21, 7.0.22, 7.0.23, 7.0.24, 7.0.25 |
|||