GitHub Advisoryadvisory · Maven

GHSA-4vwv-x3gp-2j4g The Undertow module of WildFly allows source code disclosure

HIGH Published 2022-05-17 Modified 2023-08-03 Official page ↗
Aliases
CVE-2015-3198
Ecosystem
Maven
Packages
org.wildfly:wildfly-parent
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-08-03

Affected packages

• Maven org.wildfly:wildfly-parent: >= 8.1.0.Final, < 9.0.0.CR2 → fixed in 9.0.0.CR2

Description

The Undertow module of WildFly versions 8.1.0.Final, 8.2.0.Final, 9.0.0.CR1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL.

Related

Alias · CVE (1)

  • CVE-2015-3198 The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References