1. Home
  2. CVE Database
  3. CVE-2022-2712
MEDIUM · 6.5

CVE-2022-2712

In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an rem...

Vulnerability Description

In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed application source code. This is fixed in GlassFish 7.0.0.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
EclipseGlassfish>= 5.1.0, <= 6.2.5

Related Weaknesses (CWE)

CWE-22

References

FAQ

What is CVE-2022-2712?

CVE-2022-2712 is a vulnerability with a CVSS score of 6.5 (MEDIUM). In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an rem...

How severe is CVE-2022-2712?

CVE-2022-2712 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-2712?

Check the references section above for vendor advisories and patch information. Affected products include: Eclipse Glassfish.