Listen to this Post
Eclipse GlassFish version 7.0.15 is vulnerable to Reflected Cross-Site Scripting (XSS) attacks via its Administration Console. The vulnerability arises due to improper input sanitization in user-supplied data processed by the console. An attacker can craft a malicious URL containing JavaScript payloads, which are then executed in the context of the victim’s browser when the URL is accessed. This allows session hijacking, phishing, or other client-side attacks. The flaw exists in the handling of request parameters, where unfiltered input is reflected in the server’s response without proper encoding.
DailyCVE Form:
Platform: Eclipse GlassFish
Version: 7.0.15
Vulnerability: Reflected XSS
Severity: Moderate
Date: Jul 16, 2025
Prediction: Patch by Aug 15, 2025
What Undercode Say:
curl -X GET "http://glassfish/admin?param=<script>alert('XSS')</script>"
fetch(<code>http://glassfish/admin?param=${encodeURIComponent('<script>malicious()</script>')}</code>)
How Exploit:
Craft a malicious URL with JavaScript payload, trick admin into clicking it.
Protection from this CVE:
Sanitize input, implement CSP headers.
Impact:
Session hijacking, admin compromise.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
