Threats tagged 'ghsa-gv3m-v36g-qfr6'

A critical vulnerability in the administration REST interface of Azul Payara allows remote, unauthenticated attackers to bypass secure-admin remote-access restrictions by using an arbitrary X-GlassFish-authToken HTTP header. This bypass leads to password-based authentication fallback, which succeeds without credentials on default domains with empty admin passwords, enabling execution of arbitrary administrative commands and full server compromise.