CVE-2016-0793
high · 7.5Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.
7.5
CVSS
15.6%
EPSS (exploit prob.)
97th
EPSS percentile
2016-04-01
Published
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| redhat | jboss_wildfly_application_server | 10.0.0 |
| microsoft | windows | all versions |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/136323/Wildfly-Filter-Restriction-Bypass-Information-Disclosure.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1305937
- https://security.netapp.com/advisory/ntap-20180215-0001/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03784en_us
- https://www.exploit-db.com/exploits/39573/
- http://packetstormsecurity.com/files/136323/Wildfly-Filter-Restriction-Bypass-Information-Disclosure.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1305937
- https://security.netapp.com/advisory/ntap-20180215-0001/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03784en_us
- https://www.exploit-db.com/exploits/39573/
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2016-0793