title: Payara Platform: URL Redirection to untrusted site using FORM authentication
description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows Redirect Access to Libraries.This issue affects Payara Server, Micro and Embedded: from 5.0.0 before 5.57.0, from 4.1.2.191 before 4.1.2.191.46, from 6.0.0 before 6.8.0, from 6.2023.1 before 6.2023.11.
problem types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
affected:
{
defaultStatus: unaffected
modules: Servlet Implementation
product: Payara Server, Micro and Embedded
vendor: Payara Platform
versions:
lessThan: 5.57.0, status: affected, version: 5.0.0, versionType: semver
lessThan: 4.1.2.191.46, status: affected, version: 4.1.2.191, versionType: semver
lessThan: 6.8.0, status: affected, version: 6.0.0, versionType: semver
lessThan: 6.2023.11, status: affected, version: 6.2023.1, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL