PT-2016-1632 · Red Hat · Wildfly

Tal Solomon · Publicado 2016-04-01 · Atualizado 2022-05-14 · CVE-2016-0793

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WildFly versions prior to 10.0.0.Final

Description The issue is related to an incomplete blacklist vulnerability in the servlet filter restriction mechanism. This allows remote attackers to read sensitive files in the WEB-INF or META-INF directory via a request containing lowercase or "meaningless" characters.

Recommendations For versions prior to 10.0.0.Final, update to version 10.0.0.Final or later to resolve the issue. As a temporary workaround, consider restricting access to the WEB-INF and META-INF directories to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2016-00944

CVE-2016-0793

GHSA-9Q87-22GR-R8QF

Produtos afetados

Wildfly

Referências · 11

• 🔥 https://exploit-db.com/exploits/39573 · Exploit
• https://github.com/wildfly/wildfly · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1305937 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-00944 · Nota de Segurança
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03784en_us · Nota
• https://security.netapp.com/advisory/ntap-20180215-0001 · Nota
• https://osv.dev/vulnerability/GHSA-9q87-22gr-r8qf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0793 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-0793 · Aviso do Fabricante
• http://packetstormsecurity.com/files/136323/Wildfly-Filter-Restriction-Bypass-Information-Disclosure.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0793 · Nota