UpHeron
All vulnerabilities

Servers and applications

CVE-2022-2712

In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed application source code. This is fixed in GlassFish 7.0.0.

Severity
High 7.5
Published
27 Jan 2023
Last changed
22 Jul 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Eclipse GlassFishServers and applications · cpe:a:eclipse:glassfish
  • From 5.1.0 up to 6.2.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-2712
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-2712