CVE-2025-14340 Scanner

Payara Server is a popular application server widely used for deploying Java EE applications. It is leveraged by enterprises and developers for building, integrating, and running scalable applications. The software's primary function is to provide a robust and high-performance run-time environment for applications. Payara Server is commonly used in cloud and enterprise environments, supporting microservices and cloud-native architectures. Its REST Management Interface is a key feature that allows administrators to manage applications and services effectively. Given its capabilities, Payara Server is an integral component in enterprise IT infrastructures.

The vulnerability detected is a Cross-Site Scripting (XSS) issue, which is common in web applications where user input is not properly validated or sanitized. In the case of Payara Server, the vulnerability resides in the REST Management Interface, where improperly sanitized input allows malicious scripts to execute in the admin's browser. This type of vulnerability can lead to a range of exploit scenarios, usually involving manipulation or misleading of an administrator. Attackers can inject scripts that could potentially perform unauthorized actions by tricking a logged-in admin.

The technical details of this vulnerability involve the REST Management Interface of Payara Server, where user inputs are not properly sanitized before outputting them in a response. The vulnerable parameter is within the management domain URL, allowing stored XSS payloads to be injected directly. This issue manifests when the maliciously crafted URL is accessed, executing the script within the context of the admin's session. Successful exploitation could lead to the unauthorized execution of administrative commands.

If exploited, this vulnerability can lead to significant security issues. Attackers could trick administrators into performing unwanted actions like resetting the admin password or altering configurations. This could potentially grant an attacker full administrative control over the Payara Server instance, leading to data breaches or further system compromise. In environments where Payara Server is linked with other systems, the impact could cascade, affecting the integrity of interconnected systems.

REFERENCES

• https://github.com/DeepSecurityResearch/CVE-2025-14340
• https://www.payara.fish
• https://nvd.nist.gov/vuln/detail/CVE-2025-14340