Description
In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed application source code.
Remediation
References
https://bugs.eclipse.org/580502
Related Vulnerabilities
CVE-2022-37865 Vulnerability in maven package org.apache.ivy:ivy
CVE-2023-26111 Vulnerability in npm package node-static
CVE-2017-16153 Vulnerability in npm package gaoxuyan
CVE-2021-42767 Vulnerability in maven package org.neo4j.procedure:apoc
CVE-2022-26049 Vulnerability in maven package com.diffplug.gradle:goomph