PT-2018-10150 · Red Hat · Wildfly-Core

Sam Fowler · Published 2018-07-27 · Updated 2022-05-14 · CVE-2018-10862

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions WildFly Core versions prior to 6.0.0.Alpha3

Description The issue arises from improper validation of file paths in .war archives, allowing crafted .war archives to be extracted and overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.

Recommendations For versions prior to 6.0.0.Alpha3, update to version 6.0.0.Alpha3 or later to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-10862

GHSA-W8R2-5J8X-X8J6

RHSA-2018:2276

RHSA-2018:2423

RHSA-2018:2424

RHSA-2018:2643

Affected Products

Wildfly-Core

References · 15

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2425 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10862 · Security Note
• https://access.redhat.com/errata/RHSA-2018:2424 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2428 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w8r2-5j8x-x8j6 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2276 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2279 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2643 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2423 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0877 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2277 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-10862 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10862 · Note
• https://snyk.io/research/zip-slip-vulnerability · Note