GHSA-3g5w-6pw7-6hrp
Path Traversal In Eclipse GlassFish
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.glassfish.main.web:web | >= 5.1.0, < 7.0.0 | 7.0.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed application source code.
References
External links from the advisory. They lead to third-party sites.