Path Traversal In Eclipse GlassFish

In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed application source code.

Vulnerability ID: GHSA-3g5w-6pw7-6hrp
Aliases: CVE-2022-2712
Published: 2023-01-27 12:30:29
CWE: CWE-22
Severity rating: MODERATE
CVSS: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven
name: org.glassfish.main.web:web