CVE-2024-8215: high-severity vulnerability in Payara Server
Payload Injection Attack via Management REST interface
Published
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.5%
exploitation probability
0.5%top 62% of all CVEs
observed exploitation
nono source reports it
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Payara Platform Payara Server (Admin Console modules) allows Remote Code Inclusion.This issue affects Payara Server: from 5.20.0 before 5.68.0, from 6.0.0 before 6.19.0, from 6.2022.1 before 6.2024.10, from 4.1.2.191.1 before 4.1.2.191.51.
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Payara Platform · Payara ServerRelated CVEs — Payara Server
In the same product, most dangerous first.
CVE-2025-14340HIGHAdmin Account Takeover via malicious URL payloadEPSS 1.0%CVE-2025-1534MEDIUMCross-site Scripting (Stored)EPSS 0.3%CVE-2024-45687LOWHTTP Server incorrectly accepting disallowed characters within header valuesEPSS 0.2%CVE-2024-7312HIGHREST Interface Link Redirection via Host parameterEPSS 0.2%CVE-2024-8097MEDIUMSensitive information exposure when the org.glassfish.admingui LOGGER is set to FINEST levelEPSS 0.2%