CVE-2017-1000028: GlassFish Server directory traversal via crafted HTTP GET

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityNetwork-reachable, no authentication required, high confidentiality impact, public exploit code and a near-maximum EPSS score, though not in CISA KEV.

What it is

Oracle GlassFish Server Open Source Edition 4.1 is vulnerable to directory traversal (CWE-22) reachable through a specially crafted HTTP GET request. The flaw can be triggered by both authenticated and unauthenticated users, exposing files outside the intended web root. With a network-reachable, no-privilege vector and public exploit code, it is a practical information-disclosure risk for exposed GlassFish instances.

Impact

An attacker can read arbitrary files on the server that the GlassFish process can access, potentially exposing configuration, credentials and other sensitive data. The CVSS vector shows high confidentiality impact with no integrity or availability effect.

Attack surface

Reached over the network via HTTP GET requests to the GlassFish server; the CVSS vector indicates no authentication and no user interaction required, though the description also notes authenticated exploitation is possible. Any internet- or network-exposed GlassFish 4.1 listener is in scope.

Exploitation

Public exploit code exists (Exploit-DB entries 45196 and 45198, plus a Trustwave advisory), and EPSS is very high at 0.99479 (99.943rd percentile). The CVE is not listed in CISA KEV, so no confirmed in-the-wild campaign is recorded here.

What to do

• Upgrade or patch GlassFish Server Open Source Edition 4.1 to a fixed release, or migrate off the unsupported Open Source Edition.
• If patching is not immediately possible, restrict network access to the GlassFish HTTP listener with firewall rules or a reverse proxy.
• Disable or block directory traversal patterns and normalize/validate request paths at the fronting proxy or WAF.
• Run GlassFish with least privilege so the process cannot read sensitive files outside its required directories.
• Remove or restrict access to sensitive files and configuration on hosts running GlassFish.

Detection

• Monitor HTTP access logs for GET requests containing traversal sequences such as ../, ..%2f, or encoded variants.
• Alert on requests for known sensitive paths (e.g. configuration, password or key files) from the GlassFish listener.
• Review GlassFish error responses and unusual 200 responses to file-like paths for signs of successful traversal.
• Correlate outbound or repeated scanning activity against the GlassFish HTTP port with exploit signatures for this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.