CVEvulnerability
CVE-2018-10862
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2018-07-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.5 MEDIUM — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 4.9 MEDIUM — AV:N/AC:M/Au:S/C:N/I:P/A:P
- Weaknesses
- CWE-22
Description
WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.
Affected configurations
• redhat virtualization 4.0
• redhat jboss enterprise application platform 7.1.0
• redhat wildfly core (<= 5.0.0)
• redhat wildfly core 6.0.0
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://access.redhat.com/errata/RHSA-2018:2276 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2277 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2279 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2423 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2424 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2425 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2428 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2643 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:0877 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862 Issue Tracking, Vendor Advisory
- https://snyk.io/research/zip-slip-vulnerability Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2276 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2277 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2279 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2423 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2424 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2425 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2428 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2643 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:0877 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862 Issue Tracking, Vendor Advisory
- https://snyk.io/research/zip-slip-vulnerability Third Party Advisory