CVE-2022-2712

MediumCVSS 6.5

Published: 27/01/2023(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.93%

57th percentile - higher than 57% of all known CVEs

Summary

Relative path traversal vulnerability in Eclipse GlassFish versions 5.1.0 to 6.2.5. Unauthenticated remote attacker can access configuration files and application source code. Fixed in GlassFish 7.0.0.

Risk Assessment

Risk of leakage of critical data such as server configuration and application source code without authentication.

Recommendation

Upgrade Eclipse GlassFish to version 7.0.0 or later.

Original NVD description (English source)

In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed application source code. This is fixed in GlassFish 7.0.0.