What’s Vulnerable › Vulnerabilities

CVE-2023-41699: Payara Platform: URL Redirection to untrusted site using FORM authentication

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-15 · updated 2026-06-17
• Weakness: CWE-601

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows Redirect Access to Libraries.This issue affects Payara Server, Micro and Embedded: from 5.0.0 before 5.57.0, from 4.1.2.191 before 4.1.2.191.46, from 6.0.0 before 6.8.0, from 6.2023.1 before 6.2023.11.

Affected products

• Payara Platform Payara Server: from 4.1.2.191 before 4.1.2.191.46; from 5.0.0 before 5.57.0; from 6.0.0 before 6.8.0; from 6.2023.1 before 6.2023.11 — fixed in 4.1.2.191.46, 5.57.0, 6.2023.11, 6.8.0

How to fix

Upgrade to a fixed version: Payara Platform Payara Server 4.1.2.191.46, 5.57.0, 6.2023.11, 6.8.0. Check the vendor advisory for mitigations.

References

• https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%206.2023.11.html
• https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.8.0.html
• https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%206.2023.11.html
• https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.8.0.html

Get alerted when CVE-2023-41699 or the next vulnerability affects your stack