CVE-2024-9342 is a critical (CVSS 9.8) flaw in Eclipse GlassFish versions before 8.0.3: there is no limit on failed login attempts, so passwords can be guessed without restriction. GlassFish 8.0.3 adds automatic brute force attack protection. Upgrade to 8.0.3 or later and keep the admin console off public networks.
What's affected
The record says Eclipse GlassFish versions before 8.0.3 allow login brute force attacks because there is no limit on the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection, documented in the GlassFish security guide under brute force attack protection.
One detail to know: the Eclipse CVE assignment issue that tracked the original report names a different range, saying version 7.0.16 or earlier. The published record uses the wider description, before 8.0.3, which is the safer reading. Treat any version before 8.0.3 as lacking the protection.
The CVSS vector assumes a network attack with low complexity and no privileges, and the score is high because a successful guess of an administrator password gives control of the server. The real risk depends on whether the login page can be reached by attackers and how strong the password is.
How to check if you're exposed
Check the GlassFish version first.
asadmin version
Run it on the server, or read the version from the admin console. Anything before 8.0.3 lacks the built in protection.
Then check exposure.
- Find out whether the administration console, normally on port 4848, and any application login pages are reachable from untrusted networks.
- Review access logs for bursts of failed logins from one address or many addresses.
- Check that the admin account uses a long, unique password and that default credentials are gone.
What to do now
- Find every GlassFish server and its version.
- Upgrade to 8.0.3 or later.
- Read the brute force protection section of the GlassFish security guide and confirm it is on.
- Close the admin console port to untrusted networks, or allow only a management network.
- Use long unique passwords and rotate admin credentials.
- Add alerting on repeated failed logins.
Why it matters
Without a lockout or a delay, an attacker can try passwords as fast as the server and the network allow. Weak and reused passwords then fall quickly. The class is improper restriction of excessive authentication attempts.
The fix is layered: add per account and per address throttling, add multi-factor sign in where possible, and keep management interfaces off the public internet. An application server admin console is a particularly valuable target, because control of it usually means control of the applications and data it hosts.
The weakness class is CWE-307: Improper Restriction of Excessive Authentication Attempts. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version has the fix?
The record says GlassFish 8.0.3 adds automatic brute force protection.
Is a firewall enough?
Closing the port to untrusted networks is very effective, but upgrading adds a second layer.
Sources
Last reviewed: 19 October 2026.
