EUVD-2026-53925
GHSA-325x-xm3p-mmv6
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote, low-complexity, no attacker auth (PR:N) but victim admin must interact (UI:R); token leak crosses the auth boundary (S:C) yielding full domain compromise (C:H/I:H/A:H).
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
3DescriptionCVE.org
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\> full unauthenticated takeover of Eclipse GlassFish domain until the token expires.
AnalysisAI
Server-Side Request Forgery combined with CSRF in Eclipse GlassFish's DownloadServlet ContentSources handler allows a remote attacker to exfiltrate the administrative gfresttoken to an attacker-controlled host when an authenticated administrator visits a malicious page. Affecting Eclipse GlassFish 8.0.x prior to 8.0.4, successful token theft yields full control of the GlassFish administrative domain until the token expires, effectively an unauthenticated takeover of the management plane. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an administrator who is concurrently authenticated into the Eclipse GlassFish Admin Console to be induced (via CSRF, per UI:R in the CVSS vector) to trigger a request against the DownloadServlet ContentSources feature, which then leaks the `gfresttoken` to an attacker-controlled host. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6 Critical) indicates a network-reachable, low-complexity attack requiring no attacker privileges but requiring user interaction (the administrator must visit or interact with attacker content), with a scope change and total confidentiality, integrity, and availability impact - consistent with full domain takeover following token theft. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Eclipse GlassFish 8.0.4 - upgrade all 8.0.x deployments to 8.0.4 or later, which is the primary and complete fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Eclipse GlassFish 8.0.x deployments and identify instances running versions prior to 8.0.4. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Eclipse Glassfish
View allRemote code execution in Eclipse GlassFish allows remote attackers to evaluate arbitrary Expression Language (EL) expres
Remote code execution in Eclipse GlassFish allows attackers with administrative access to the Administration Console to
HTTP request smuggling in Eclipse Grizzly before 5.0.2 stems from the framework's inability to correctly parse malformed
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today