CVE-2022-2712 MEDIUM

CVE-2022-2712

Vendor The Eclipse Foundation
Product Eclipse GlassFish
Weakness CWE-22 · Path traversal
Published January 27, 2023
Last update March 27, 2025

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed application source code.

Key dates

02Disclosure timeline

January 27, 2023 CVE published
March 27, 2025 Record updated