GitHub Advisoryadvisory · Maven

GHSA-9q87-22gr-r8qf WildFly has incomplete blacklist vulnerability

HIGH Published 2022-05-14 Modified 2025-04-14 Official page ↗
Aliases
CVE-2016-0793
Ecosystem
Maven
Packages
org.wildfly:wildfly-parent, org.wildfly:wildfly-undertow
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2025-04-14

Affected packages

• Maven org.wildfly:wildfly-parent: < 10.0.0.Final → fixed in 10.0.0.Final • Maven org.wildfly:wildfly-undertow: < 10.0.0.Final → fixed in 10.0.0.Final

Description

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.

Related

Alias · CVE (1)

  • CVE-2016-0793 Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References