~ / search / GHSA-w8r2-5j8x-x8j6

GHSA-w8r2-5j8x-x8j6

Improper Limitation of a Pathname to a Restricted Directory in WildFly

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-10862

Packages

EcosystemPackageAffectedFixed in
Maven org.wildfly.core:wildfly-server < 6.0.0.Alpha3 6.0.0.Alpha3

Details

As written in the advisory (Markdown source, shown as plain text).

WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.

References

External links from the advisory. They lead to third-party sites.