-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability involves unauthenticated path traversal in the default context root. Analysis of GlassFish/Payara architecture indicates static resource handling via DefaultServlet is the most likely candidate. The serveResource() method is responsible for resolving requested paths and serving files. The blog post's context about default root exposure and lack of authentication requirement aligns with this being a pre-patch flaw in path validation within core resource serving logic. While direct patch evidence is unavailable, the CWE pattern and Payara architecture strongly suggest this entry point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| fish.payara.api:payara-bom | maven | < 5.2022.3 | 5.2022.3 |