WildFly has incomplete blacklist vulnerability

ALTO 7.5CVE-2016-0793 · GHSA-9q87-22gr-r8qf · Published 01/04/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
org.wildfly:wildfly-parent Maven	`< 10.0.0.Final`	`10.0.0.Final`
org.wildfly:wildfly-undertow Maven	`< 10.0.0.Final`	`10.0.0.Final`
jboss wildfly application server redhat	`= 10.0.0`	No fix yet

Description

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2016-0793 · ADVISORY
bugzilla.redhat.com/show_bug.cgi · WEB
wildfly/wildfly · PACKAGE
security.netapp.com/advisory/ntap-20180215-0001 · WEB
support.hpe.com/hpsc/doc/public/display · WEB
exploit-db.com/exploits/39573 · WEB
packetstormsecurity.com/files/136323/Wildfly-Filter-Restriction-Bypass-Information-Disclosure.html · WEB
security.netapp.com/advisory/ntap-20180215-0001
exploit-db.com/exploits/39573

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free