« Volver al listado

CVE-2024-7312

Estado: AnalizadaAlta (7)—

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session Hijacking.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.2020.2 before 5.2022.5, from 5.20.0 before 5.67.0, from 4.1.2.191.0 before 4.1.2.191.50.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Payara — Payara

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-7312",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-7312",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-11T18:12:12.528111Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7,
          "Automatable": "NOT_DEFINED",
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "ACTIVE",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8",
      "affectedData": [
        {
          "vendor": "Payara Platform",
          "modules": [
            "REST Management Interface"
          ],
          "product": "Payara Server",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.0",
              "lessThan": "6.18.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.2022.1",
              "lessThan": "6.2024.9",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.2020.2",
              "lessThan": "5.2022.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.20.0",
              "lessThan": "5.67.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.1.2.191.0",
              "lessThan": "4.1.2.191.50",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:payara:payara:*:*:*:*:enterprise:*:*:*"
          ],
          "vendor": "payara",
          "product": "payara",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.0",
              "lessThan": "6.18.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.2022.1",
              "lessThan": "6.2024.6",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.2020.2",
              "lessThan": "5.2022.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.1.2.191.0",
              "lessThan": "4.1.2.191.50",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-09-11T16:15:08.080",
  "references": [
    {
      "url": "https://docs.payara.fish/enterprise/docs/5.67.0/Release%20Notes/Release%20Notes%205.67.0.html",
      "tags": [
        "Release Notes"
      ],
      "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"
    },
    {
      "url": "https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.18.0.html",
      "tags": [
        "Release Notes"
      ],
      "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "769c9ae7-73c3-4e47-ae19-903170fc3eb8",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session Hijacking.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.2020.2 before 5.2022.5, from 5.20.0 before 5.67.0, from 4.1.2.191.0 before 4.1.2.191.50."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de redirección de URL a un sitio no confiable ('Redirección abierta') en Payara Platform Payara Server (módulos de interfaz de administración REST) permite el secuestro de sesión. Este problema afecta a Payara Server: desde 6.0.0 antes de 6.18.0, desde 6.2022.1 antes de 6.2024.9, desde 5.2020.2 antes de 5.2022.5, desde 5.20.0 antes de 5.67.0, desde 4.1.2.191.0 antes de 4.1.2.191.50."
    }
  ],
  "lastModified": "2026-06-17T08:19:49.920",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:payara:payara:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2CB09C88-3E34-43D4-AD55-73821A0F462E",
              "versionEndExcluding": "4.1.2.191.50",
              "versionStartIncluding": "4.1.2.191.0"
            },
            {
              "criteria": "cpe:2.3:a:payara:payara:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34A634E3-24B0-4E29-8B62-8E6F6A68D0AA",
              "versionEndExcluding": "5.67.0",
              "versionStartIncluding": "5.20.0"
            },
            {
              "criteria": "cpe:2.3:a:payara:payara:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0E17F5A-30D2-407F-8570-8B82509B9055",
              "versionEndExcluding": "5.2022.5",
              "versionStartIncluding": "5.2020.2"
            },
            {
              "criteria": "cpe:2.3:a:payara:payara:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF14AD8C-DBCC-4739-9058-9AF97D71323E",
              "versionEndExcluding": "6.18.0",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:payara:payara:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A479A71-9114-46E4-BFA3-BB7FD36FA56A",
              "versionEndExcluding": "6.2024.9",
              "versionStartIncluding": "6.2022.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "769c9ae7-73c3-4e47-ae19-903170fc3eb8"
}