CVE-2016-0793 WildFly has incomplete blacklist vulnerability
HighCVSS 7.5
EPSS 15.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.wildfly/wildfly-parent(Maven) | < 10.0.0.Final | 10.0.0.Final |
| org.wildfly/wildfly-parent(Maven) | = 10.0.0.Alpha1 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 10.0.0.Alpha2 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 10.0.0.Alpha3 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 10.0.0.Alpha4 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 10.0.0.Alpha5 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 10.0.0.Alpha6 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 10.0.0.Beta1 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 10.0.0.Beta2 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 10.0.0.CR1 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 10.0.0.CR2 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 10.0.0.CR3 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 10.0.0.CR4 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 10.0.0.CR5 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 8.0.0.Alpha1 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 8.0.0.Alpha2 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 8.0.0.Alpha3 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 8.0.0.Alpha4 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 8.0.0.Beta1 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 8.0.0.CR1 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 8.0.0.Final | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 8.1.0.CR1 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 8.1.0.CR2 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 8.1.0.Final | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 8.2.0.Final | No fix listed |
Show 44 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.wildfly/wildfly-parent(Maven) | = 8.2.1.Final | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 9.0.0.Alpha1 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 9.0.0.Beta1 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 9.0.0.Beta2 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 9.0.0.CR1 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 9.0.0.CR2 | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 9.0.0.Final | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 9.0.1.Final | No fix listed |
| org.wildfly/wildfly-parent(Maven) | = 9.0.2.Final | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | < 10.0.0.Final | 10.0.0.Final |
| org.wildfly/wildfly-undertow(Maven) | = 10.0.0.Alpha1 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 10.0.0.Alpha2 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 10.0.0.Alpha3 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 10.0.0.Alpha4 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 10.0.0.Alpha5 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 10.0.0.Alpha6 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 10.0.0.Beta1 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 10.0.0.Beta2 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 10.0.0.CR1 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 10.0.0.CR2 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 10.0.0.CR3 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 10.0.0.CR4 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 10.0.0.CR5 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 8.0.0.Alpha1 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 8.0.0.Alpha2 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 8.0.0.Alpha3 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 8.0.0.Alpha4 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 8.0.0.Beta1 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 8.0.0.CR1 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 8.0.0.Final | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 8.1.0.CR1 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 8.1.0.CR2 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 8.1.0.Final | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 8.2.0.Final | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 8.2.1.Final | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 9.0.0.Alpha1 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 9.0.0.Beta1 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 9.0.0.Beta2 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 9.0.0.CR1 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 9.0.0.CR2 | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 9.0.0.Final | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 9.0.1.Final | No fix listed |
| org.wildfly/wildfly-undertow(Maven) | = 9.0.2.Final | No fix listed |
| redhat jboss wildfly application server | = 10.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com vendor-advisory
- github.com product
- security.netapp.com
- support.hpe.com
- 39573 exploit
- packetstormsecurity.com exploit
- github.com