CVEvulnerability
CVE-2016-0793
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-04-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.
Affected configurations
• redhat jboss wildfly application server 10.0.0
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://packetstormsecurity.com/files/136323/Wildfly-Filter-Restriction-Bypass-Information-Disclosure.html packetstormsecurity.com
- https://bugzilla.redhat.com/show_bug.cgi?id=1305937 Vendor Advisory
- https://security.netapp.com/advisory/ntap-20180215-0001/ security.netapp.com
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03784en_us support.hpe.com
- https://www.exploit-db.com/exploits/39573/ www.exploit-db.com
- http://packetstormsecurity.com/files/136323/Wildfly-Filter-Restriction-Bypass-Information-Disclosure.html packetstormsecurity.com
- https://bugzilla.redhat.com/show_bug.cgi?id=1305937 Vendor Advisory
- https://security.netapp.com/advisory/ntap-20180215-0001/ security.netapp.com
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03784en_us support.hpe.com
- https://www.exploit-db.com/exploits/39573/ www.exploit-db.com