7.3
CVE-2025-14340
- EPSS 1%
- Veröffentlicht 18.02.2026 13:39:11
- Zuletzt bearbeitet 15.04.2026 00:35:42
- Quelle 769c9ae7-73c3-4e47-ae19-903170
- CVE-Watchlists
- Unerledigt
Admin Account Takeover via malicious URL payload
Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerPayara Platform
≫
Produkt
Payara Server
Default Statusunaffected
Version <=
4.1.2.191.53
Version
4.1.153.1
Status
affected
Version <=
5.82.0
Version
5.20.0
Status
affected
Version <=
6.33.0
Version
6.0.0
Status
affected
Version <=
7.2025.2
Version
7.2024.1.Alpha1
Status
affected
Version <=
6.2025.11
Version
6.2022.1
Status
affected
Version <=
5.2022.5
Version
5.2020.2
Status
affected
Version <=
5.201.2
Version
5.181
Status
affected
Version
4.1.2.191.54
Status
unaffected
Version
5.83.0
Status
unaffected
Version
6.34.0
Status
unaffected
Version
7.2026.1
Status
unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1% | 0.583 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| 769c9ae7-73c3-4e47-ae19-903170fc3eb8 | 7.3 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:U/V:X/RE:M/U:Red
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
https://docs.payara.fish/enterprise/docs/Security/Security%20Fix%20List.html