CVE-2022-37422 Path Traversal in Payara
Unauthenticated attackers can perform directory traversal to read arbitrary files on Payara Server, Micro, and Embedded instances.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-37422?
CVE-2022-37422 is a high-severity path traversal vulnerability in n/a, published on 18 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Payara through 5.2022.2 allows directory traversal without authentication. This affects Payara Server, Payara Micro, and Payara Server Embedded.
Weakness: CWE-22
Which versions are affected by CVE-2022-37422?
2 open source packages ship an affected version, including fish.payara.api:payara-bom. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fish.payara.api:payara-bom Maven | All versions | 5.2022.3 |
fish.payara.api:payara-bom Maven | All versions | 5.2022.3 |
Products include Payara Payara.
How do I fix CVE-2022-37422?
Upgrade fish.payara.api:payara-bom to 5.2022.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-37422 being exploited?
There is no known exploitation of CVE-2022-37422 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2024-8215 Payload Injection Attack via Management REST interface
- CVE-2022-45129 Payara, when deployed to the root context, allows attackers to visit META-INF and WEB-INF
- CVE-2024-7312 REST Interface Link Redirection via Host parameter
- CVE-2025-1534 Cross-site Scripting (Stored)
- CVE-2023-41699 Payara Platform: URL Redirection to untrusted site using FORM authentication
Sources
Also known as GHSA-h28c-453m-h9xm.