Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to i…

1. 2009-05-05 First public exploit (EDB-32981)
2. 2009-05-06 Published

8.20% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

• EDB-32981 GlassFish Enterprise Server 2.1 - Admin Console '/resourceNode/jdbcResourceEdit.jsf?name' Cross-Site Scripting remote, 2009-05-05
• EDB-32980 GlassFish Enterprise Server 2.1 - Admin Console '/configuration/auditModuleEdit.jsf?name' Cross-Site Scripting remote, 2009-05-05
• EDB-32979 GlassFish Enterprise Server 2.1 - Admin Console /webService/webServicesGeneral.jsf URI Cross-Site Scripting remote, 2009-05-05
• EDB-32978 GlassFish Enterprise Server 2.1 - Admin Console /sysnet/registration.jsf URI Cross-Site Scripting remote, 2009-05-05
• EDB-32977 GlassFish Enterprise Server 2.1 - Admin Console /resourceNode/resources.jsf URI Cross-Site Scripting remote, 2009-05-05
• EDB-32975 GlassFish Enterprise Server 2.1 - Admin Console /customMBeans/customMBeans.jsf URI Cross-Site Scripting remote, 2009-05-05
• EDB-32974 GlassFish Enterprise Server 2.1 - Admin Console /configuration/configuration.jsf URI Cross-Site Scripting remote, 2009-05-05
• EDB-32971 GlassFish Enterprise Server 2.1 - Admin Console /applications/applications.jsf URI Cross-Site Scripting remote, 2009-05-05
• nabble.com http://www.nabble.com/-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html referenced PoC, tagged "exploit" by a source, unverified
• dsecrg.com http://dsecrg.com/pages/vul/show.php?id=134 referenced PoC, tagged "exploit" by a source, unverified
• securityfocus.com http://www.securityfocus.com/bid/34824 referenced PoC, tagged "exploit" by a source, unverified

Weakness

• CWE-79 Improper Neutralization of Input During Web Page Generation

• glassfish.dev.java.net /servlets/ReadMsg?list=cvs&msgNo=29675

  mailing-list, patch, vendor-advisory

• glassfish.dev.java.net /servlets/ReadMsg?list=cvs&msgNo=29669

  mailing-list, patch, vendor-advisory

• glassfish.dev.java.net /servlets/ReadMsg?list=cvs&msgNo=29668

  mailing-list, patch, vendor-advisory

• nabble.com /-DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p22595435.html

  mailing-list, exploit

• dsecrg.com /pages/vul/show.php?id=134

  exploit

• securityfocus.com /bid/34824

  vdb-entry, exploit

• sunsolve.sun.com /search/document.do?assetkey=1-26-258528-1

  vendor-advisory

• securityfocus.com /archive/1/503236/100/0/threaded

  mailing-list

• osvdb.org /54254

  vdb-entry

• osvdb.org /54256

  vdb-entry

• nabble.com /Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html

  mailing-list

• osvdb.org /54250

  vdb-entry

• osvdb.org /54253

  vdb-entry

• osvdb.org /54257

  vdb-entry

• exchange.xforce.ibmcloud.com /vulnerabilities/50453

  vdb-entry

• jvndb.jvn.jp /en/contents/2009/JVNDB-2009-000027.html

  third-party-advisory

• vupen.com /english/advisories/2009/1255

  vdb-entry

• osvdb.org /54252

  vdb-entry

• osvdb.org /54255

  vdb-entry

• osvdb.org /54249

  vdb-entry

• jvn.jp /en/jp/JVN73653977/index.html

  third-party-advisory

• osvdb.org /54251

  vdb-entry

• securityfocus.com /bid/34914

  vdb-entry

• CVE List CVE-2009-1553
• NVD CVE-2009-1553

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.