CVE-2022-45129: Payara, when deployed to the root context, allows attackers to visit META-INF and WEB-INF
(updated )
Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.
References
- blog.payara.fish/whats-new-in-the-november-2022-payara-platform-release
- docs.payara.fish/community/docs/6.2022.1/Release%20Notes/Release%20Notes%206.2022.1.html
- docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%205.2022.4.html
- docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%205.45.0.html
- github.com/advisories/GHSA-q35w-85pq-rv3x
- github.com/payara/Payara
- github.com/payara/Payara/commit/cccdfddeda71c78ae7b3179db5429e1bb8a56b2e
- github.com/payara/Payara/issues/6136
- github.com/payara/Payara/issues?q=FISH-6775
- nvd.nist.gov/vuln/detail/CVE-2022-45129
Code Behaviors & Features
Detect and mitigate CVE-2022-45129 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →