Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2018-10862

WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.

CVSS v3:

  • Severity: Medium
  • Score: 5.5
  • AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS v2:

  • Severity: Low
  • Score: 4.9
  • AV:N/AC:M/Au:S/C:N/I:P/A:P

CWEs:

OWASP TOP 10:

Software From Fixed in
redhat / virtualization 4.0 4.0.x
redhat / jboss_enterprise_application_platform 7.1.0 7.1.0.x
redhat / wildfly_core 6.0.0-alpha1 6.0.0-alpha1.x
redhat / wildfly_core 6.0.0-alpha2 6.0.0-alpha2.x
redhat / wildfly_core - 5.0.0.x
org.wildfly.core / wildfly-server - 6.0.0.Alpha3