CVE-2024-9342

State: Published
Severity: 6.3 Medium
Published: Jul 16, 2025
Updated: Jun 18, 2026
Reserved: Sep 30, 2024

Description

In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/security-guide.html#brute-force-attack-protection .

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N	eclipse

Weaknesses

CWE-307 Improper Restriction of Excessive Authentication Attempts

Affected Products

Product	Versions
Eclipse GlassfishEclipse Foundation	5.1.0Affected 6.0.0 through 6.2.5Affected 7.0.0 through 7.0.25Affected 7.1.0Affected 8.0.0 to before 8.0.3Affected

References

https://gitlab.eclipse.org/security/cve-assignement/-/issues/33

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.