Lucene search

PayaraCVE-2024-7312

HistorySep 11, 2024 - 4:15 p.m.

CVE-2024-7312

2024-09-1116:15:08

CWE-601

Payara

web.nvd.nist.gov

url redirection

payara platform

session hijacking

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS4

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

ACTIVE

CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:A/VC:H/SC:N/VI:H/SI:H/VA:H/SA:H

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session Hijacking.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.2020.2 before 5.2022.5, from 5.20.0 before 5.67.0, from 4.1.2.191.0 before 4.1.2.191.50.

Affected configurations

Nvd

Node

payarapayaraRange4.1.2.191.0–4.1.2.191.50community

payarapayaraRange5.20.0–5.67.0enterprise

payarapayaraRange5.2020.2–5.2022.5community

payarapayaraRange6.0.0–6.18.0enterprise

payarapayaraRange6.2022.1–6.2024.9community

VendorProductVersionCPE
payarapayara*cpe:2.3:a:payara:payara:*:*:*:*:community:*:*:*
payarapayara*cpe:2.3:a:payara:payara:*:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
payara	payara	*	cpe:2.3:a:payara:payara:::::community:::*
payara	payara	*	cpe:2.3:a:payara:payara:::::enterprise:::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "REST Management Interface"
    ],
    "product": "Payara Server",
    "vendor": "Payara Platform",
    "versions": [
      {
        "lessThan": "6.18.0",
        "status": "affected",
        "version": "6.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "6.2024.9",
        "status": "affected",
        "version": "6.2022.1",
        "versionType": "semver"
      },
      {
        "lessThan": "5.2022.5",
        "status": "affected",
        "version": "5.2020.2",
        "versionType": "semver"
      },
      {
        "lessThan": "5.67.0",
        "status": "affected",
        "version": "5.20.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.1.2.191.50",
        "status": "affected",
        "version": "4.1.2.191.0",
        "versionType": "custom"
      }
    ]
  }
]

References

docs.payara.fish/enterprise/docs/5.67.0/Release%20Notes/Release%20Notes%205.67.0.html

docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.18.0.html

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS4

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

ACTIVE

CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:A/VC:H/SC:N/VI:H/SI:H/VA:H/SA:H

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

Related for CVE-2024-7312