CVE-2022-2712
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
Relative path traversal vulnerability in Eclipse GlassFish versions 5.1.0 to 6.2.5. Unauthenticated remote attacker can access configuration files and application source code. Fixed in GlassFish 7.0.0.
Risk Assessment
Risk of leakage of critical data such as server configuration and application source code without authentication.
Recommendation
Upgrade Eclipse GlassFish to version 7.0.0 or later.
Other vulnerabilities in Eclipse GlassFish
See all- CVE-2026-12605Critical
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console, leading to full unauthenticated takeover of the GlassFish domain until the token expires.
- CVE-2026-2587Critical
A critical remote code execution vulnerability in the server-side template rendering mechanism used by the Glassfish gadget handler allows an attacker to inject EL expressions, leading to full host compromise.
- CVE-2026-2586Critical
An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.
- CVE-2024-9342Critical
In Eclipse GlassFish versions before 8.0.3, it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts.
Original NVD description (English source)
In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed application source code. This is fixed in GlassFish 7.0.0.