CVE-2024-8646: Eclipse Glassfish

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed. This vulnerability is caused by the vulnerability (CVE-2023-41080) in the Apache code included in GlassFish. This vulnerability only affects applications that are explicitly deployed to the root context ('/').

Affected products

• Eclipse Glassfish: from 5.1.0, before 7.0.10 (fixed in 7.0.10)

Published 2024-09-11. Last modified 2026-06-17.