CVE-2016-0793 (高 7.5) · Watchpost

← 脆弱性一覧

WildFly has incomplete blacklist vulnerability

高 7.5CVE-2016-0793 · GHSA-9q87-22gr-r8qf · 01/04/2016 公開 · 17/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
org.wildfly:wildfly-parent Maven	`< 10.0.0.Final`	`10.0.0.Final`
org.wildfly:wildfly-undertow Maven	`< 10.0.0.Final`	`10.0.0.Final`
jboss wildfly application server redhat	`= 10.0.0`	修正版なし

概要

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.

NVD の説明

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.

参考情報

nvd.nist.gov/vuln/detail/CVE-2016-0793 · ADVISORY
bugzilla.redhat.com/show_bug.cgi · WEB
wildfly/wildfly · PACKAGE
security.netapp.com/advisory/ntap-20180215-0001 · WEB
support.hpe.com/hpsc/doc/public/display · WEB
exploit-db.com/exploits/39573 · WEB
packetstormsecurity.com/files/136323/Wildfly-Filter-Restriction-Bypass-Information-Disclosure.html · WEB
security.netapp.com/advisory/ntap-20180215-0001
exploit-db.com/exploits/39573

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン