PT-2018-9900 · Red Hat · Undertow+1

Bharti Kundal · Publicado 2018-01-24 · Atualizado 2023-02-03 · CVE-2018-1048

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jboss EAP version 7.1.0.GA

Description: The AJP connector in undertow does not use the ALLOW ENCODED SLASH option, allowing slash and anti-slash characters to be encoded in the URL. This could lead to path traversal, resulting in the disclosure of arbitrary local files.

Recommendations: For Jboss EAP version 7.1.0.GA, consider disabling the AJP connector until a patch is available to prevent path traversal attacks. Restrict access to sensitive local files to minimize the risk of information disclosure.

Correção

Improper Encoding or Escaping of Output

Path traversal

Enumeração de Fraquezas

CWE-116

CWE-22

Identificadores relacionados

CVE-2018-1048

GHSA-PRFW-3QX6-G9XR

RHSA-2018:0479

RHSA-2018:0480

RHSA-2018:0481

Produtos afetados

Jboss Eap

Undertow

Referências · 14

• https://access.redhat.com/errata/RHSA-2018:0481 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:0478 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1534343 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1048 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1048 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2018:0480 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-1048 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:0479 · Aviso do Fabricante
• https://t.me/cvenotify/43515 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1048 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1048 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-1048 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-1048 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-prfw-3qx6-g9xr · Aviso do Fabricante