{"action":"Upgrade fish.payara.distributions:payara to 5.2022.5 (5.x) or 6.2022.2 (6.x) or later.","affected":[{"fixed":"6.2022.2","introduced":"6.2021.1.Alpha1"},{"fixed":"5.2022.5","introduced":"5.0.0.Alpha1"},{"introduced":"0","last_affected":"4.1.2.181"}],"component":"fish.payara.distributions:payara","cve_ids":["CVE-2022-45129"],"ecosystem":"Maven","epss":0.01509,"exploited":false,"fixed_versions":["6.2022.2","5.2022.5"],"ghsa_id":"GHSA-q35w-85pq-rv3x","id":"tcs_01M5N98FX7MB2XHB72R5HZWD7C","modified_at":"2025-09-04T18:57:28.147499Z","published_at":"2022-11-10T12:01:03Z","references":["https://osv.dev/vulnerability/GHSA-q35w-85pq-rv3x","https://nvd.nist.gov/vuln/detail/CVE-2022-45129","https://github.com/payara/Payara/issues/6136","https://github.com/payara/Payara/commit/cccdfddeda71c78ae7b3179db5429e1bb8a56b2e","https://blog.payara.fish/whats-new-in-the-november-2022-payara-platform-release","https://docs.payara.fish/community/docs/6.2022.1/Release%20Notes/Release%20Notes%206.2022.1.html","https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%205.2022.4.html","https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%205.45.0.html","https://github.com/payara/Payara","https://github.com/payara/Payara/issues?q=FISH-6775","http://packetstormsecurity.com/files/169864/Payara-Platform-Path-Traversal.html","http://seclists.org/fulldisclosure/2022/Nov/11"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-q35w-85pq-rv3x","url":"https://osv.dev/vulnerability/GHSA-q35w-85pq-rv3x"}],"summary":"Payara, when deployed to the root context, allows attackers to visit META-INF and WEB-INF"}