high7.5Public exploit code
CVE-2016-0793
WildFly has incomplete blacklist vulnerability
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Wildfly - 'WEB-INF' / 'META-INF' Information Disclosure via Filter Restriction Bypass2016-03-20 · webapps · windows · Verified
Impact
Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.wildfly:wildfly-parent | < 10.0.0.Final | 10.0.0.Final |
| maven | org.wildfly:wildfly-undertow | < 10.0.0.Final | 10.0.0.Final |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Jboss Wildfly Application Server | Version 10.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://packetstormsecurity.com/files/136323/Wildfly-Filter-Restriction-Bypass-Information-Disclosure.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1305937
- https://security.netapp.com/advisory/ntap-20180215-0001/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03784en_us
- https://www.exploit-db.com/exploits/39573/
- https://github.com/advisories/GHSA-9q87-22gr-r8qf
- https://nvd.nist.gov/vuln/detail/CVE-2016-0793
- https://security.netapp.com/advisory/ntap-20180215-0001
- https://www.exploit-db.com/exploits/39573