CVE-2022-45129

Katalog CVE

CVSS 7.5 · High EPSS 1,4%

Kerentanan Files or Directories Accessible to External Parties pada payara. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.

Rincian

Terbit di NVD

10 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.payara.fish/whats-new-in-the-november-2022-payara-platform-release release notes · advisory vendor
• https://docs.payara.fish/community/docs/6.2022.1/Release%20Notes/Release%20Notes%206.2022.1.html release notes · advisory vendor
• https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%205.2022.4.html release notes · advisory vendor
• https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%205.45.0.html release notes · advisory vendor
• https://github.com/payara/Payara/commit/cccdfddeda71c78ae7b3179db5429e1bb8a56b2e patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/169864/Payara-Platform-Path-Traversal.html exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2022/Nov/11 mailing list · advisory pihak ketiga