CVE-2024-9342 describes an improper restriction of excessive authentication attempts (CWE-307) in Eclipse GlassFish prior to version 8.0.3. The affected versions do not limit the number of failed login attempts, enabling brute force attacks. The vulnerability is addressed starting with GlassFish 8.0.3, which implements automatic brute force attack protection as documented by the vendor.

Attackers can perform unlimited login attempts on vulnerable GlassFish versions, increasing the risk of unauthorized access through brute force. The CVSS 4.0 score is 6.3 (medium severity), reflecting the network attack vector with low complexity and no required privileges or user interaction. The vulnerability does not directly escalate privileges or cause denial of service but compromises authentication security.

Upgrade to Eclipse GlassFish version 8.0.3 or later, which includes automatic brute force attack protection. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed in the advisory, but the vendor documents the fix in version 8.0.3. Users should consult the official GlassFish security guide for configuration details.