2024-09-11 18:03:18 +00:00
{
"id" : "CVE-2024-7312" ,
"sourceIdentifier" : "769c9ae7-73c3-4e47-ae19-903170fc3eb8" ,
"published" : "2024-09-11T16:15:08.080" ,
2024-09-13 18:03:19 +00:00
"lastModified" : "2024-09-13T16:27:50.577" ,
"vulnStatus" : "Analyzed" ,
2024-09-11 18:03:18 +00:00
"cveTags" : [ ] ,
"descriptions" : [
{
"lang" : "en" ,
"value" : "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session Hijacking.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.2020.2 before 5.2022.5, from 5.20.0 before 5.67.0, from 4.1.2.191.0 before 4.1.2.191.50."
2024-09-13 18:03:19 +00:00
} ,
{
"lang" : "es" ,
"value" : "Vulnerabilidad de redirecci\u00f3n de URL a un sitio no confiable ('Redirecci\u00f3n abierta') en Payara Platform Payara Server (m\u00f3dulos de interfaz de administraci\u00f3n REST) permite el secuestro de sesi\u00f3n. Este problema afecta a Payara Server: desde 6.0.0 antes de 6.18.0, desde 6.2022.1 antes de 6.2024.9, desde 5.2020.2 antes de 5.2022.5, desde 5.20.0 antes de 5.67.0, desde 4.1.2.191.0 antes de 4.1.2.191.50."
2024-09-11 18:03:18 +00:00
}
] ,
"metrics" : {
"cvssMetricV40" : [
{
"source" : "769c9ae7-73c3-4e47-ae19-903170fc3eb8" ,
"type" : "Secondary" ,
"cvssData" : {
"version" : "4.0" ,
"vectorString" : "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" ,
"attackVector" : "LOCAL" ,
"attackComplexity" : "HIGH" ,
"attackRequirements" : "NONE" ,
"privilegesRequired" : "HIGH" ,
"userInteraction" : "ACTIVE" ,
"vulnerableSystemConfidentiality" : "HIGH" ,
"vulnerableSystemIntegrity" : "HIGH" ,
"vulnerableSystemAvailability" : "HIGH" ,
"subsequentSystemConfidentiality" : "NONE" ,
"subsequentSystemIntegrity" : "HIGH" ,
"subsequentSystemAvailability" : "HIGH" ,
"exploitMaturity" : "NOT_DEFINED" ,
"confidentialityRequirements" : "NOT_DEFINED" ,
"integrityRequirements" : "NOT_DEFINED" ,
"availabilityRequirements" : "NOT_DEFINED" ,
"modifiedAttackVector" : "NOT_DEFINED" ,
"modifiedAttackComplexity" : "NOT_DEFINED" ,
"modifiedAttackRequirements" : "NOT_DEFINED" ,
"modifiedPrivilegesRequired" : "NOT_DEFINED" ,
"modifiedUserInteraction" : "NOT_DEFINED" ,
"modifiedVulnerableSystemConfidentiality" : "NOT_DEFINED" ,
"modifiedVulnerableSystemIntegrity" : "NOT_DEFINED" ,
"modifiedVulnerableSystemAvailability" : "NOT_DEFINED" ,
"modifiedSubsequentSystemConfidentiality" : "NOT_DEFINED" ,
"modifiedSubsequentSystemIntegrity" : "NOT_DEFINED" ,
"modifiedSubsequentSystemAvailability" : "NOT_DEFINED" ,
"safety" : "NOT_DEFINED" ,
"automatable" : "NOT_DEFINED" ,
"recovery" : "NOT_DEFINED" ,
"valueDensity" : "NOT_DEFINED" ,
"vulnerabilityResponseEffort" : "NOT_DEFINED" ,
"providerUrgency" : "NOT_DEFINED" ,
"baseScore" : 7.0 ,
"baseSeverity" : "HIGH"
}
}
2024-09-13 18:03:19 +00:00
] ,
"cvssMetricV31" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "REQUIRED" ,
"scope" : "CHANGED" ,
"confidentialityImpact" : "LOW" ,
"integrityImpact" : "LOW" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 6.1 ,
"baseSeverity" : "MEDIUM"
} ,
"exploitabilityScore" : 2.8 ,
"impactScore" : 2.7
}
2024-09-11 18:03:18 +00:00
]
} ,
"weaknesses" : [
2024-09-13 18:03:19 +00:00
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-601"
}
]
} ,
2024-09-11 18:03:18 +00:00
{
"source" : "769c9ae7-73c3-4e47-ae19-903170fc3eb8" ,
"type" : "Secondary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-601"
}
]
}
] ,
2024-09-13 18:03:19 +00:00
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:payara:payara:*:*:*:*:community:*:*:*" ,
"versionStartIncluding" : "4.1.2.191.0" ,
"versionEndExcluding" : "4.1.2.191.50" ,
"matchCriteriaId" : "2CB09C88-3E34-43D4-AD55-73821A0F462E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:payara:payara:*:*:*:*:enterprise:*:*:*" ,
"versionStartIncluding" : "5.20.0" ,
"versionEndExcluding" : "5.67.0" ,
"matchCriteriaId" : "34A634E3-24B0-4E29-8B62-8E6F6A68D0AA"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:payara:payara:*:*:*:*:community:*:*:*" ,
"versionStartIncluding" : "5.2020.2" ,
"versionEndExcluding" : "5.2022.5" ,
"matchCriteriaId" : "E0E17F5A-30D2-407F-8570-8B82509B9055"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:payara:payara:*:*:*:*:enterprise:*:*:*" ,
"versionStartIncluding" : "6.0.0" ,
"versionEndExcluding" : "6.18.0" ,
"matchCriteriaId" : "EF14AD8C-DBCC-4739-9058-9AF97D71323E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:payara:payara:*:*:*:*:community:*:*:*" ,
"versionStartIncluding" : "6.2022.1" ,
"versionEndExcluding" : "6.2024.9" ,
"matchCriteriaId" : "2A479A71-9114-46E4-BFA3-BB7FD36FA56A"
}
]
}
]
}
] ,
2024-09-11 18:03:18 +00:00
"references" : [
{
2024-09-11 22:03:18 +00:00
"url" : "https://docs.payara.fish/enterprise/docs/5.67.0/Release%20Notes/Release%20Notes%205.67.0.html" ,
2024-09-13 18:03:19 +00:00
"source" : "769c9ae7-73c3-4e47-ae19-903170fc3eb8" ,
"tags" : [
"Release Notes"
]
2024-09-11 18:03:18 +00:00
} ,
{
"url" : "https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.18.0.html" ,
2024-09-13 18:03:19 +00:00
"source" : "769c9ae7-73c3-4e47-ae19-903170fc3eb8" ,
"tags" : [
"Release Notes"
]
2024-09-11 18:03:18 +00:00
}
]
}
