PT-2018-10150 · Red Hat · Wildfly-Core

Sam Fowler · Publicado 2018-07-27 · Atualizado 2022-05-14 · CVE-2018-10862

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions WildFly Core versions prior to 6.0.0.Alpha3

Description The issue arises from improper validation of file paths in .war archives, allowing crafted .war archives to be extracted and overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.

Recommendations For versions prior to 6.0.0.Alpha3, update to version 6.0.0.Alpha3 or later to resolve the issue.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-10862

GHSA-W8R2-5J8X-X8J6

RHSA-2018:2276

RHSA-2018:2423

RHSA-2018:2424

RHSA-2018:2643

Produtos afetados

Wildfly-Core

Referências · 15

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:2425 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-10862 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2018:2424 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:2428 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-w8r2-5j8x-x8j6 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:2276 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:2279 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:2643 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:2423 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2019:0877 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10862 · Nota
• https://snyk.io/research/zip-slip-vulnerability · Nota
• https://access.redhat.com/errata/RHSA-2018:2277 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-10862 · Aviso do Fabricante