{"id":"CVE-2022-45129","aliases":["EUVD-2022-48046","GHSA-q35w-85pq-rv3x"],"status":"published","title":"Payara, when deployed to the root context, allows attackers to visit META-INF and WEB-INF","description":"Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01853,"percentile":0.79297,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-552"],"published":"2022-11-10T00:00:00Z","modified":"2026-10-28T02:30:58Z","fixes":[{"ecosystem":"Maven","package":"fish.payara.distributions:payara","fixed_in":["6.2022.2","5.2022.2","5.2022.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"fish.payara.distributions:payara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2021.1.Alpha1"},{"fixed":"6.2022.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"fish.payara.distributions:payara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0.Alpha1"},{"fixed":"5.2022.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"fish.payara.distributions:payara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.2.181"}]}]},{"source":"osv","ecosystem":"Maven","package":"fish.payara.distributions:payara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2021.1.Alpha1"},{"fixed":"6.2022.2"}]}],"versions":["6.2021.1.Alpha1","6.2022.1","6.2022.1.Alpha2","6.2022.1.Alpha3","6.2022.1.Alpha4"]},{"source":"osv","ecosystem":"Maven","package":"fish.payara.distributions:payara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0.Alpha1"},{"fixed":"5.2022.5"}]}],"versions":["5.0.0.Alpha1","5.0.0.Alpha2","5.0.0.Alpha3","5.181","5.182","5.183","5.184","5.191","5.192","5.193","5.193.1","5.194","5.201","5.2020.2","5.2020.3","5.2020.4","5.2020.5","5.2020.6","5.2020.7","5.2021.1","5.2021.10","5.2021.2","5.2021.3","5.2021.4","5.2021.5","5.2021.6","5.2021.7","5.2021.8","5.2021.9","5.2022.1","5.2022.2","5.2022.3","5.2022.4"]},{"source":"osv","ecosystem":"Maven","package":"fish.payara.distributions:payara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.2.181"}]}],"versions":["4.1.1.161","4.1.1.161.1","4.1.1.162","4.1.1.163","4.1.1.164","4.1.1.171","4.1.1.171.0.1","4.1.1.171.1","4.1.2.172","4.1.2.173","4.1.2.174","4.1.2.181"]}],"products":[{"vendor":"payara","product":"payara"}],"references":[{"url":"https://blog.payara.fish/whats-new-in-the-november-2022-payara-platform-release","tags":["x_transferred","Release Notes","Vendor Advisory","article","web"]},{"url":"https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%205.45.0.html","tags":["x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%205.2022.4.html","tags":["x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"https://docs.payara.fish/community/docs/6.2022.1/Release%20Notes/Release%20Notes%206.2022.1.html","tags":["x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"https://github.com/payara/Payara/commit/cccdfddeda71c78ae7b3179db5429e1bb8a56b2e","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"http://seclists.org/fulldisclosure/2022/Nov/11","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"http://packetstormsecurity.com/files/169864/Payara-Platform-Path-Traversal.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45129","tags":["advisory"]},{"url":"https://github.com/payara/Payara/issues/6136","tags":["web"]},{"url":"https://github.com/payara/Payara/issues?q=FISH-6775","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q35w-85pq-rv3x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/45xxx/CVE-2022-45129.json","tags":["advisory"]},{"url":"https://github.com/payara/Payara","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-45129","description":"Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.","status":"published","published":"2022-11-10T00:00:00Z","modified":"2025-05-01T13:42:02.196Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:34:31.519788Z"}],"euvd":[{"id":"EUVD-2022-48046","description":"Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.","status":"published","published":"2022-11-10T00:00:00Z","modified":"2025-05-01T13:42:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:51:57.509565Z"}],"ghsa":[{"id":"GHSA-q35w-85pq-rv3x","title":"Payara, when deployed to the root context, allows attackers to visit META-INF and WEB-INF","description":"Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.","status":"published","published":"2022-11-10T12:01:03Z","modified":"2025-09-04T20:32:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:38:57.074217Z"}],"nvd":[{"id":"CVE-2022-45129","description":"Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.","status":"published","published":"2022-11-10T06:15:13.813Z","modified":"2026-06-17T05:09:24.65Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:07:31.914793Z"}],"osv":[{"id":"CVE-2022-45129","description":"Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.","status":"published","published":"2022-11-10T00:00:00Z","modified":"2026-10-28T02:30:58.101499743Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"GHSA-q35w-85pq-rv3x","title":"Payara, when deployed to the root context, allows attackers to visit META-INF and WEB-INF","description":"Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.","status":"published","published":"2022-11-10T12:01:03Z","modified":"2025-09-04T18:57:28.147499Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T15:46:54.055966Z"}]}}