CVE-2022-45129: High severity Payara Payara vulnerability

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2022-45129.

Q: What is the severity of CVE-2022-45129?

The severity of CVE-2022-45129 is high (7.5).

Q: How can attackers exploit CVE-2022-45129?

Attackers can visit META-INF and WEB-INF by deploying Payara to the root context.

Q: Is there a fix for CVE-2022-45129?

Yes, updating to Payara Platform Community 4.1.2.191.38, 5.2022.4, or 6.2022.1, or Payara Platform Enterprise 5.45.0 will fix the vulnerability.

Published Nov 10, 2022

Updated

Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.

Affected Software

4 affected components

Payara Payara<4.1.2.191.38

Payara Payara<5.45.0

Payara Payara>=5.0.0<5.2022.4

Payara Payara>=6.0.0<6.2022.1

Remediation

Patch Available

https://github.com/payara/Payara/commit/cccdfddeda71c78ae7b3179db5429e1bb8a56b2e

Event History

Nov 10, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·06:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2022-45129.

What is the severity of CVE-2022-45129?

The severity of CVE-2022-45129 is high (7.5).

Which software versions are affected by CVE-2022-45129?

Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0 are affected.

How can attackers exploit CVE-2022-45129?