{"action":"Upgrade fish.payara.server:payara-aggregator to 6.2022.1.Alpha3 or later.","affected":[{"fixed":"6.2022.1.Alpha3","introduced":"5.2020.1"}],"component":"fish.payara.server:payara-aggregator","cve_ids":["CVE-2023-28462"],"ecosystem":"Maven","epss":0.00938,"exploited":false,"fixed_versions":["6.2022.1.Alpha3"],"ghsa_id":"GHSA-xc93-587g-mxm7","id":"tcs_01M5N9J4N3A0D05ANQDW98ZJCK","modified_at":"2023-11-08T04:12:11.630330Z","published_at":"2023-03-30T21:30:21Z","references":["https://osv.dev/vulnerability/GHSA-xc93-587g-mxm7","https://nvd.nist.gov/vuln/detail/CVE-2023-28462","https://blog.payara.fish/vulnerability-affecting-server-environments-on-java-1.8-on-updates-lower-than-1.8u191","https://github.com/payara/Payara"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-xc93-587g-mxm7","url":"https://osv.dev/vulnerability/GHSA-xc93-587g-mxm7"}],"summary":"Payara Server allows remote attackers to load malicious code on the server once a JNDI directory scan is performed"}