The administration console of a GlassFish or Payara Java application server — full deployment control.
IANA registers 4848 as appserv-http, App Server Admin HTTP, and that is exactly what it is: the default admin listener of Sun/Oracle GlassFish, its Eclipse successor Eclipse GlassFish, and the Payara fork. The quick-start guide points administrators at http://localhost:4848, and the same port serves the asadmin CLI's remote commands. Whoever reaches it can deploy applications, which on a Java application server means running arbitrary code.
Do not expose
Deploying a WAR through this console is remote code execution by design; keep it on localhost or a management network, and never publish it even with authentication enabled.
$ curl -sk -o /dev/null -w '%{http_code}\n' --max-time 5 https://TARGET:4848/Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.