CVE-2023-41699: 
Payara Micro vulnerability analysis and mitigation

URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) that allows Redirect Access to Libraries. The vulnerability affects multiple versions: Payara Server, Micro and Embedded from 5.0.0 before 5.57.0, from 4.1.2.191 before 4.1.2.191.46, from 6.0.0 before 6.8.0, and from 6.2023.1 before 6.2023.11 (NVD).

The vulnerability is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect'). It has been assigned a CVSS v3.1 Base Score of 6.1 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The scoring indicates that the vulnerability is network accessible, requires low attack complexity, needs no privileges, requires user interaction, has changed scope, and can impact both confidentiality and integrity at a low level, with no impact on availability (NVD).

The vulnerability can lead to unauthorized redirect access to libraries, potentially allowing attackers to redirect users to untrusted sites. This could result in low-level compromises of both confidentiality and integrity of the affected systems (NVD).

The vulnerability requires network access and user interaction to exploit, with low attack complexity. No authentication is required to execute the attack, making it relatively accessible to potential attackers (NVD).

The vulnerability has been fixed in Payara Server versions 5.57.0, 4.1.2.191.46, 6.8.0, and 6.2023.11. Users are advised to upgrade to these or later versions to mitigate the vulnerability (Payara Release Notes).