CVE-2022-2712 Path Traversal In Eclipse GlassFish

What is CVE-2022-2712?

CVE-2022-2712 is a medium-severity path traversal vulnerability in The Eclipse Foundation Eclipse GlassFish, published on 27 Jan 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed application source code. This is fixed in GlassFish 7.0.0.

Weakness: CWE-22

Which versions are affected by CVE-2022-2712?

2 open source packages ship an affected version, including org.glassfish.main.web:web. It affects 1 product.

Products include Eclipse Glassfish.

How do I fix CVE-2022-2712?

Upgrade org.glassfish.main.web:web to 7.0.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-2712 being exploited?

There is no known exploitation of CVE-2022-2712 in the wild and no public exploit code.

Other vulnerabilities in The Eclipse Foundation Eclipse GlassFish

• CVE-2026-12605 Server-side request forgery in Eclipse GlassFish Critical 9.6
• CVE-2026-2587 GlassFish's gadget handler is vulnerable to RCE Critical 9.6
• CVE-2026-2586 GlassFish's Administration Console is Vulnerable to RCE Critical 9.1
• CVE-2024-9408 Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints High 8.9
• CVE-2024-9329 Glassfish redirect to untrusted site Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3g5w-6pw7-6hrp, UBUNTU-CVE-2022-2712.