GitHub Advisoryadvisory · Maven

GHSA-fmr4-w67p-vh8x Improper Input Validation in org.wildfly:wildfly-undertow

MEDIUM Published 2018-10-19 Modified 2023-02-13 Official page ↗

Aliases: CVE-2018-1047
Ecosystem: Maven
Packages: org.wildfly:wildfly-undertow
Severity: Moderate
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-20, CWE-22
Reviewed: 2020-06-16

Affected packages

• Maven org.wildfly:wildfly-undertow: < 12.0.0 → fixed in 12.0.0

Description

A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files.

Alias · CVE (1)

CVE-2018-1047 A flaw was found in Wildfly 9.x. vulnerability

Weakness · CWE (2)

CWE-20 Improper Input Validation weakness
CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References

https://nvd.nist.gov/vuln/detail/CVE-2018-1047 advisory
https://access.redhat.com/errata/RHSA-2018:1247 web
https://access.redhat.com/errata/RHSA-2018:1248 web
https://access.redhat.com/errata/RHSA-2018:1249 web
https://access.redhat.com/errata/RHSA-2018:1251 web
https://access.redhat.com/errata/RHSA-2018:2938 web
https://access.redhat.com/security/cve/CVE-2018-1047 web
https://bugzilla.redhat.com/show_bug.cgi?id=1528361 web
https://github.com/advisories/GHSA-fmr4-w67p-vh8x advisory
https://issues.jboss.org/browse/WFLY-9620 web