Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2025-14340

Admin Account Takeover via malicious URL payload

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Payara

Description

Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Payara Platform Payara Server

Default version status: unaffected

  • 4.1.153.1 to ≤ 4.1.2.191.53affected
  • 5.20.0 to ≤ 5.82.0affected
  • 6.0.0 to ≤ 6.33.0affected
  • 7.2024.1.Alpha1 to ≤ 7.2025.2affected
  • 6.2022.1 to ≤ 6.2025.11affected
  • 5.2020.2 to ≤ 5.2022.5affected
  • 5.181 to ≤ 5.201.2affected
  • 4.1.2.191.54unaffected
  • 5.83.0unaffected
  • 6.34.0unaffected
  • 7.2026.1unaffected

References