CVE-2024-9342
Eclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/security-guide.html#brute-force-attack-protection .
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/security-guide.html#brute-force-attack-protection .
- Record
CVE-2024-9342- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N - Weakness
- CWE-307
- Updated
- 2026-11-02
EUVDEUVD-2024-54788
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/security-guide.html#brute-force-attack-protection .
- Record
EUVD-2024-54788- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-99f7-hp6j-v6q4
Eclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts
In Eclipse GlassFish version 7.0.16 or earlier, it is possible to perform login brute force attacks as there is no limitation on the number of failed login attempts.
- Record
GHSA-99f7-hp6j-v6q4- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N - Weakness
- CWE-307
- Updated
- 2026-11-02
NVD
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/security-guide.html#brute-force-attack-protection .
- Record
CVE-2024-9342- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-307
- Updated
- 2026-11-02
OSV
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/security-guide.html#brute-force-attack-protection .
- Record
CVE-2024-9342- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N - Weakness
- CWE-307
- Updated
- 2026-11-02
OSVGHSA-99f7-hp6j-v6q4
Eclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts
In Eclipse GlassFish version 7.0.16 or earlier, it is possible to perform login brute force attacks as there is no limitation on the number of failed login attempts.
- Record
GHSA-99f7-hp6j-v6q4- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N - Weakness
- CWE-307
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.glassfish.main.admingui:console-commonMaven |
through 7.0.25 | None known |
org.glassfish.main.admingui:console-commonMaven |
through 7.0.25, plus listed versions 3.1.23.1.2.24.04.0-b334.0-b72 Show 45 moreShow less4.0-b904.14.1.14.1.25.05.0.15.1.05.1.0-RC15.1.0-RC26.0.06.0.0-M16.0.0-RC16.0.0-RC26.0.0-RC36.0.0-RC46.1.06.2.06.2.16.2.26.2.36.2.46.2.57.0.07.0.0-M17.0.0-M107.0.0-M27.0.0-M37.0.0-M47.0.17.0.107.0.117.0.127.0.137.0.147.0.157.0.167.0.177.0.187.0.197.0.27.0.207.0.217.0.227.0.237.0.24 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-9342 is a medium vulnerability (CVSS 6.3) in Eclipse Glassfish, published July 16, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. No source names a fixed version.
References
gitlab.eclipse.org/security/cve-assignement/-/issues/33
nvd.nist.gov/vuln/detail/CVE-2024-9342
github.com/advisories/GHSA-99f7-hp6j-v6q4
Left out here: 7 versions. The JSON record has them.