Posted by Ron E on Sep 03 Description:

Payara Server contains a vulnerability in its Server-Side Includes (SSI)

implementation that allows arbitrary operating system command execution via

the #exec directive. The issue occurs because user-controlled SSI

directives are passed directly to Runtime.exec() without validation,

sanitization, or restriction. An attacker who can cause the server to

process an SSI file (e.g., .shtml) can execute arbitrary OS commands with

the...