CVE-2024-7312

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session Hijacking.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.2020.2 before 5.2022.5, from 5.20.0 before 5.67.0, from 4.1.2.191.0 before 4.1.2.191.50.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
Payara Platform	Payara Server	>= 6.0.0, < 6.18.0; >= 6.2022.1, < 6.2024.9; >= 5.2020.2, < 5.2022.5; >= 5.20.0, < 5.67.0; >= 4.1.2.191.0, < 4.1.2.191.50
payara	payara	>= 6.0.0, < 6.18.0; >= 6.2022.1, < 6.2024.6; >= 5.2020.2, < 5.2022.5; >= 4.1.2.191.0, < 4.1.2.191.50

References

Timeline

Published: Sep 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-73136.1The Shield Security WordPress plugin before 20.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading CVE-2024-73149.8anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to CVE-2024-73157.5The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when gene CVE-2024-73165.9Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric CNC Series allows a remote unauthenticated attacker CVE-2024-73175.4The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Stored Cr CVE-2024-73184.8A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds CVE-2024-73195.0An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack CVE-2024-73209.8A vulnerability classified as critical has been found in itsourcecode Online Blood Bank Management System 1.0. This affects an unknown part CVE-2024-73216.1A vulnerability classified as problematic was found in itsourcecode Online Blood Bank Management System 1.0. This vulnerability affects unkn CVE-2024-73225.8A ZigBee coordinator, router, or end device may change their node ID when an unsolicited encrypted rejoin response is received, this change CVE-2024-73236.5Digiwin EasyFlow .NET lacks proper access control for specific functionality, and the functionality do not adequately filter user input. A r CVE-2024-73247.8A vulnerability was found in IObit iTop Data Recovery Pro 4.4.0.687. It has been declared as critical. Affected by this vulnerability is an