CVE-2022-45129

Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.

• CWE-552
• CWE-552

• http://packetstormsecurity.com/files/169864/Payara-Platform-Path-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Nov/11Mailing List, Third Party Advisory
• https://blog.payara.fish/whats-new-in-the-november-2022-payara-platform-releaseRelease Notes, Vendor Advisory
• https://docs.payara.fish/community/docs/6.2022.1/Release%20Notes/Release%20Notes%206.2022.1.htmlRelease Notes, Vendor Advisory
• https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%205.2022.4.htmlRelease Notes, Vendor Advisory
• https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%205.45.0.htmlRelease Notes, Vendor Advisory
• https://github.com/payara/Payara/commit/cccdfddeda71c78ae7b3179db5429e1bb8a56b2ePatch, Third Party Advisory
• http://packetstormsecurity.com/files/169864/Payara-Platform-Path-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Nov/11Mailing List, Third Party Advisory
• https://blog.payara.fish/whats-new-in-the-november-2022-payara-platform-releaseRelease Notes, Vendor Advisory
• https://docs.payara.fish/community/docs/6.2022.1/Release%20Notes/Release%20Notes%206.2022.1.htmlRelease Notes, Vendor Advisory
• https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%205.2022.4.htmlRelease Notes, Vendor Advisory
• https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%205.45.0.htmlRelease Notes, Vendor Advisory
• https://github.com/payara/Payara/commit/cccdfddeda71c78ae7b3179db5429e1bb8a56b2ePatch, Third Party Advisory

Published

Nov 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-45122Cross-site scripting vulnerability in Movable Type Movable T…6.1
• CVE-2022-45124An information disclosure vulnerability exists in the User a…7.5
• CVE-2022-45125Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-45126Kernel subsystem within OpenHarmony-v3.1.4 and prior version…7.8
• CVE-2022-45127Sewio’s Real-Time Location System (RTLS) Studio version 2.0.…8.1
• CVE-2022-45128Improper authorization in the Intel(R) EMA software before v…5.5
• CVE-2022-4513A vulnerability, which was classified as problematic, has be…6.1
• CVE-2022-45130Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/c…6.5
• CVE-2022-45132In Linaro Automated Validation Architecture (LAVA) before 20…9.8
• CVE-2022-45133Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10…6.5
• CVE-2022-45134Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10…9.8
• CVE-2022-45135Improper Neutralization of Special Elements used in an SQL C…9.8