CVE-2022-45129 Payara, when deployed to the root context, allows attackers to visit META-INF and WEB-INF
Attackers can access sensitive META-INF and WEB-INF directories when Payara is deployed to the root context, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-45129?
CVE-2022-45129 is a high-severity vulnerability in n/a, published on 10 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.
Weakness: CWE-552
Which versions are affected by CVE-2022-45129?
6 open source packages ship an affected version, including fish.payara.distributions:payara. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fish.payara.distributions:payara Maven | All versions to 4.1.2.181 | None |
fish.payara.distributions:payara Maven | All versions to 4.1.2.181 | None |
fish.payara.distributions:payara Maven | From 5.0.0.Alpha1 | 5.2022.5 |
fish.payara.distributions:payara Maven | From 5.0.0.Alpha1 | 5.2022.5 |
fish.payara.distributions:payara Maven | From 6.2021.1.Alpha1 | 6.2022.2 |
fish.payara.distributions:payara Maven | From 6.2021.1.Alpha1 | 6.2022.2 |
Products include Payara Payara.
How do I fix CVE-2022-45129?
Upgrade fish.payara.distributions:payara to a fixed version for your release line: 5.2022.5 or 6.2022.2.
Is CVE-2022-45129 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-45129 exists.
Other vulnerabilities in n/a
- CVE-2024-8215 Payload Injection Attack via Management REST interface
- CVE-2022-37422 Path Traversal in Payara
- CVE-2024-7312 REST Interface Link Redirection via Host parameter
- CVE-2025-1534 Cross-site Scripting (Stored)
- CVE-2023-41699 Payara Platform: URL Redirection to untrusted site using FORM authentication
Sources
Also known as GHSA-q35w-85pq-rv3x.