Skip to content
OpenAdvisories
Medium · 4.5 CVE-2024-10029 EUVD-2024-54792GHSA-vqrm-83g6-pfv4

Eclipse GlassFish is vulnerable to Reflected XSS attacks through its Administration Console

Published Jul 16, 2025 · Updated Jul 16, 2025 · Assigned by eclipse

Vendor: Eclipse Foundation Product: Eclipse Glassfish Package: org.glassfish.main.admingui:console-cluster-plugin Package: org.glassfish.main.admingui:console-common Ecosystem: Maven

Description

In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting
attacks in the Administration Console.

Affected products

VendorProductAffectedFixed
Eclipse Foundation Eclipse Glassfish 7.0.15 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.glassfish.main.admingui:console-cluster-plugin <= 7.0.25 — GHSA-vqrm-83g6-pfv4
Maven org.glassfish.main.admingui:console-common <= 7.0.25 — GHSA-vqrm-83g6-pfv4

References