Description
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/security-guide.html#brute-force-attack-protection .
Published: 2025-07-16
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-54788 Eclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts
Github GHSA Github GHSA GHSA-99f7-hp6j-v6q4 Eclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts
History

Thu, 18 Jun 2026 16:45:00 +0000

Type Values Removed Values Added
Description In Eclipse GlassFish version 7.0.16 or earlier it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/security-guide.html#brute-force-attack-protection .
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Jul 2025 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Eclipse
Eclipse glassfish
CPEs cpe:2.3:a:eclipse:glassfish:7.0.16:*:*:*:*:*:*:*
Vendors & Products Eclipse
Eclipse glassfish
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00016}

Wed, 16 Jul 2025 10:30:00 +0000

Type Values Removed Values Added
Description In Eclipse GlassFish version 7.0.16 or earlier it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts.
Weaknesses CWE-307
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Eclipse Glassfish
cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-06-18T13:59:24.218Z

Reserved: 2024-09-30T15:55:47.833Z

Link: CVE-2024-9342

cve-icon Vulnrichment

Updated: 2025-07-16T14:28:32.328Z

cve-icon NVD

Status : Analyzed

Published: 2025-07-16T11:15:23.727

Modified: 2025-07-16T19:55:45.470

Link: CVE-2024-9342

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-307

    Improper Restriction of Excessive Authentication Attempts