Lucene search

PayaraCVE-2023-41699

HistoryNov 15, 2023 - 8:15 p.m.

CVE-2023-41699

2023-11-1520:15:07

CWE-601

Payara

web.nvd.nist.gov

cve-2023-41699

url redirection

open redirect

payara platform

security vulnerability

payara server

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

17.0%

JSON

URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows Redirect Access to Libraries.This issue affects Payara Server, Micro and Embedded: from 5.0.0 before 5.57.0, from 4.1.2.191 before 4.1.2.191.46, from 6.0.0 before 6.8.0, from 6.2023.1 before 6.2023.11.

Affected configurations

Nvd

Node

payarapayaraRange4.1.2.191–4.1.2.191.46community

payarapayaraRange5.0.0–5.57.0enterprise

payarapayaraRange6.0.0–6.8.0enterprise

payarapayaraRange6.2023.1–6.2023.11community

VendorProductVersionCPE
payarapayara*cpe:2.3:a:payara:payara:*:*:*:*:community:*:*:*
payarapayara*cpe:2.3:a:payara:payara:*:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
payara	payara	*	cpe:2.3:a:payara:payara:::::community:::*
payara	payara	*	cpe:2.3:a:payara:payara:::::enterprise:::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "Servlet Implementation"
    ],
    "product": "Payara Server, Micro and Embedded",
    "vendor": "Payara Platform",
    "versions": [
      {
        "lessThan": "5.57.0",
        "status": "affected",
        "version": "5.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.1.2.191.46",
        "status": "affected",
        "version": "4.1.2.191",
        "versionType": "semver"
      },
      {
        "lessThan": "6.8.0",
        "status": "affected",
        "version": "6.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "6.2023.11",
        "status": "affected",
        "version": "6.2023.1",
        "versionType": "semver"
      }
    ]
  }
]

References

docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%206.2023.11.html

docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.8.0.html

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

17.0%

JSON

Related for CVE-2023-41699