PT-2016-1632 · Red Hat · Wildfly

Tal Solomon · Published 2016-04-01 · Updated 2022-05-14 · CVE-2016-0793

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WildFly versions prior to 10.0.0.Final

Description The issue is related to an incomplete blacklist vulnerability in the servlet filter restriction mechanism. This allows remote attackers to read sensitive files in the WEB-INF or META-INF directory via a request containing lowercase or "meaningless" characters.

Recommendations For versions prior to 10.0.0.Final, update to version 10.0.0.Final or later to resolve the issue. As a temporary workaround, consider restricting access to the WEB-INF and META-INF directories to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-00944

CVE-2016-0793

GHSA-9Q87-22GR-R8QF

Affected Products

Wildfly

References · 11

• 🔥 https://exploit-db.com/exploits/39573 · Exploit
• https://bugzilla.redhat.com/show_bug.cgi?id=1305937 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00944 · Security Note
• https://osv.dev/vulnerability/GHSA-9q87-22gr-r8qf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0793 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0793 · Vendor Advisory
• https://github.com/wildfly/wildfly · Note
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03784en_us · Note
• https://security.netapp.com/advisory/ntap-20180215-0001 · Note
• http://packetstormsecurity.com/files/136323/Wildfly-Filter-Restriction-Bypass-Information-Disclosure.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0793 · Note