GHSA-9q87-22gr-r8qf

Source

https://github.com/advisories/GHSA-9q87-22gr-r8qf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9q87-22gr-r8qf/GHSA-9q87-22gr-r8qf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9q87-22gr-r8qf

Aliases

CVE-2016-0793

Published

2022-05-14T03:25:02Z

Modified

2025-04-14T21:12:17.503149Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

WildFly has incomplete blacklist vulnerability

Details

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.

Database specific

{
    "nvd_published_at": "2016-04-01T19:59:00Z",
    "cwe_ids": [
        "CWE-200"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-14T20:25:47Z"
}

References

Affected packages

Maven / org.wildfly:wildfly-parent

Package

Name: org.wildfly:wildfly-parent; View open source insights on deps.dev
Purl: pkg:maven/org.wildfly/wildfly-parent

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

10.0.0.Final

Affected versions

8.*

8.0.0.Alpha1

8.0.0.Alpha2

8.0.0.Alpha3

8.0.0.Alpha4

8.0.0.Beta1

8.0.0.CR1

8.0.0.Final

8.1.0.CR1

8.1.0.CR2

8.1.0.Final

8.2.0.Final

8.2.1.Final

9.*

9.0.0.Alpha1

9.0.0.Beta1

9.0.0.Beta2

9.0.0.CR1

9.0.0.CR2

9.0.0.Final

9.0.1.Final

9.0.2.Final

10.*

10.0.0.Alpha1

10.0.0.Alpha2

10.0.0.Alpha3

10.0.0.Alpha4

10.0.0.Alpha5

10.0.0.Alpha6

10.0.0.Beta1

10.0.0.Beta2

10.0.0.CR1

10.0.0.CR2

10.0.0.CR3

10.0.0.CR4

10.0.0.CR5

Maven / org.wildfly:wildfly-undertow