CVE-2024-9342

CRITICAL

Eclipse GlassFish <= 7.0.16 - Unauthenticated Login Brute Force

Title source: llm

Description

In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/security-guide.html#brute-force-attack-protection .

References (1)

Core 1

Core References

Issue Tracking

https://gitlab.eclipse.org/security/cve-assignement/-/issues/33

Scores

CVSS v3 9.8

EPSS 0.0040

EPSS Percentile 33.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-307

Status published

Products (7)

eclipse/glassfish 7.0.16

Eclipse Foundation/Eclipse Glassfish 5.1.0

Eclipse Foundation/Eclipse Glassfish 6.0.0 - 6.2.5

Eclipse Foundation/Eclipse Glassfish 7.0.0 - 7.0.25

Eclipse Foundation/Eclipse Glassfish 7.1.0

Eclipse Foundation/Eclipse Glassfish 8.0.0 - 8.0.3

org.glassfish.main.admingui/console-common 0Maven

Published Jul 16, 2025

Tracked Since Feb 18, 2026