Eclipse GlassFish Login Brute Force Vulnerability

A brute force vulnerability in the login mechanism of Eclipse GlassFish has been identified, affecting versions through 7.0.16. The issue arises from the absence of restrictions on the number of failed login attempts, allowing attackers to repeatedly guess credentials without facing any penalties or delays.

Impact

Exploitation of this vulnerability could lead to unauthorized access through successful login after guessing credentials, potentially allowing attackers to gain inappropriate access to user accounts or administrative privileges, depending on the roles assigned to the compromised accounts.