GitHub Advisoryadvisory · Maven

GHSA-prfw-3qx6-g9xr Improper Limitation of a Pathname to a Restricted Directory in Jboss EAP Undertow

HIGH Published 2022-05-13 Modified 2022-06-30 Official page ↗
Aliases
CVE-2018-1048
Ecosystem
Maven
Packages
org.jboss.eap:wildfly-undertow
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2022-06-30

Affected packages

• Maven org.jboss.eap:wildfly-undertow: >= 7.1.0.GA, < 7.1.1.GA → fixed in 7.1.1.GA

Description

It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files.

Related

Alias · CVE (1)

  • CVE-2018-1048 It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References