CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2023-28462
Critical (9.8) in payara payara server. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in fish.payara.server:payara-aggregator 6.2022.1.Alpha3.
A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community), when Java 1.8u181 and earlier is used, allows remote attackers to load malicious code on the server once a JNDI directory scan is performed.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- payara:payara_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xc93-587g-mxm7 | Maven | fish.payara.server:payara-aggregator | >=5.2020.1 <6.2022.1.Alpha3 | 6.2022.1.Alpha3 |