UBUNTU-CVE-2022-2712

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2022-2712

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2712.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2022-2712

Upstream

CVE-2022-2712

Published

2023-01-27T10:15:00Z

Modified

2026-09-16T14:00:55Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed application source code. This is fixed in GlassFish 7.0.0.

References

Affected packages

Ubuntu:16.04:LTS / glassfish

Package

Name: glassfish
Purl: pkg:deb/ubuntu/glassfish?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1:2.*

1:2.1.1-b31g+dfsg1-3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "glassfish-activation",
            "binary_version": "1:2.1.1-b31g+dfsg1-3"
        },
        {
            "binary_name": "glassfish-javaee",
            "binary_version": "1:2.1.1-b31g+dfsg1-3"
        },
        {
            "binary_name": "glassfish-jmac-api",
            "binary_version": "1:2.1.1-b31g+dfsg1-3"
        },
        {
            "binary_name": "glassfish-mail",
            "binary_version": "1:2.1.1-b31g+dfsg1-3"
        },
        {
            "binary_name": "glassfish-toplink-essentials",
            "binary_version": "1:2.1.1-b31g+dfsg1-3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2712.json"

Ubuntu:18.04:LTS / glassfish