Description
Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.
References (7)
Core 7
Core References
Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/169864/Payara-Platform-Path-Traversal.html
Release Notes, Vendor Advisory
https://blog.payara.fish/whats-new-in-the-november-2022-payara-platform-release
Release Notes, Vendor Advisory
https://docs.payara.fish/community/docs/6.2022.1/Release%20Notes/Release%20Notes%206.2022.1.html
Release Notes, Vendor Advisory
https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%205.2022.4.html
Release Notes, Vendor Advisory
https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%205.45.0.html
Patch, Third Party Advisory
https://github.com/payara/Payara/commit/cccdfddeda71c78ae7b3179db5429e1bb8a56b2e
Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2022/Nov/11
Scores
CVSS v3
7.5
EPSS
0.0134
EPSS Percentile
67.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-552
Status
published
Products (3)
fish.payara.distributions/payara
6.2021.1.Alpha1 - 6.2022.2Maven
payara/payara
< 4.1.2.191.38
payara/payara
< 5.45.0
Published
Nov 10, 2022
Tracked Since
Feb 18, 2026