CVE-2024-9408 is a critical (CVSS 9.8) server side request forgery in Eclipse GlassFish since version 6.2.5, in specific endpoints. The Eclipse tracking issue refers to the download log endpoint. The record names no fixed version, so check the Eclipse security notices and keep the admin console private.
What's affected
The record says Eclipse GlassFish since version 6.2.5 allows a server side request forgery attack in specific endpoints. It does not give an upper version or a fixed release.
The Eclipse CVE assignment issue is titled as a GlassFish SSRF vulnerability in the /download/log endpoint, which links the record to the log download feature of the administration side. The issue page we could read is a template with few details, so we cannot say more about the affected range.
Because no fixed version appears, check the Eclipse GlassFish release notes and the Eclipse security issue list for the first release that names this CVE. The sibling record in this range, CVE-2024-9342, was fixed by the 8.0.3 release, but the sources do not tie this CVE to that release, so do not assume it.
How to check if you're exposed
Start by finding which GlassFish versions you run.
asadmin version
Anything from 6.2.5 onward is in scope of the record until you confirm a fix.
Then check whether the administration console, normally on port 4848, is reachable from anywhere other than a management network. SSRF in an admin endpoint is most dangerous when it can be triggered by a stranger, so exposure matters.
Finally, look in your access logs for requests to the log download endpoint with unusual parameters, especially from addresses you do not recognize, and check outbound connections from the server to internal addresses that it has no reason to contact.
What to do now
- List GlassFish servers and versions, noting any at 6.2.5 or later.
- Check Eclipse release notes and security issues for the fixed release and upgrade.
- Close the admin console to untrusted networks.
- Restrict outbound traffic from the server to the destinations it needs.
- Block access to cloud metadata addresses from the application server where possible.
- Review access logs for unusual requests to the log download endpoint.
Why it matters
Server side request forgery tricks a server into making a request on the attacker's behalf. The server sits inside the network, so it can often reach addresses an outsider cannot, such as internal services and cloud metadata endpoints that hand out credentials.
The class is server side request forgery. Defenses include allowlisting destinations, refusing requests to private ranges, and limiting what the server's network is allowed to reach. Even when an application is later patched, outbound filtering is a good safety net for the next bug of this kind.
The weakness class is CWE-918: Server-Side Request Forgery. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
Which endpoint is involved?
The Eclipse tracking issue refers to the download log endpoint.
Is 8.0.3 the fix?
The sources do not say so. 8.0.3 is documented for the brute force record, CVE-2024-9342. Check the release notes for this CVE.
Sources
Last reviewed: 19 October 2026.
