CVE-2024-9342
Published: 16 July 2025
Summary
CVE-2024-9342 is a medium-severity Improper Restriction of Excessive Authentication Attempts (CWE-307) vulnerability in Eclipse Glassfish. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Password Guessing (T1110.001); ranked in the top 39.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-7 (Unsuccessful Logon Attempts) and SC-5 (Denial-of-service Protection).
Deeper analysis
CVE-2024-9342 affects Eclipse GlassFish version 7.0.16 and earlier, where there is no limitation on the number of failed login attempts, enabling login brute force attacks. This vulnerability, classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts), received a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its network accessibility, low complexity, and lack of prerequisites for exploitation.
Unauthenticated remote attackers can exploit this vulnerability by performing unlimited login attempts against exposed authentication endpoints, potentially guessing valid credentials through brute force if passwords are weak or predictable. Successful exploitation could grant unauthorized access to the application server, resulting in high impacts on confidentiality, integrity, and availability as per the CVSS metrics.
Mitigation details are available in the Eclipse security advisory at https://gitlab.eclipse.org/security/cve-assignement/-/issues/33, published on 2025-07-16.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54788
Vulnerability details
In Eclipse GlassFish version 7.0.16 or earlier it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables unlimited login attempts for password guessing on exposed auth endpoints (CWE-307).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-7 enforces limits on the number of consecutive unsuccessful logon attempts, directly preventing brute force attacks enabled by the absence of such restrictions in Eclipse GlassFish.
SC-5 protects against denial-of-service impacts from excessive login attempts that could exhaust resources during brute force exploitation of the vulnerable authentication endpoints.
SI-4 monitors for indicators of brute force attacks through detection of anomalous patterns in failed login attempts against the GlassFish server.