{"containers": {"cna": {"affected": [{"product": "undertow as shipped in Jboss EAP 7.1.0.GA", "vendor": "Red Hat, Inc.", "versions": [{"status": "affected", "version": "7.1.0.GA"}]}], "datePublic": "2018-01-15T00:00:00", "descriptions": [{"lang": "en", "value": "It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-12-04T18:00:57", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "RHSA-2018:0479", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:0479"}, {"name": "RHSA-2018:0481", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:0481"}, {"name": "RHSA-2018:0480", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:0480"}, {"name": "RHSA-2018:0478", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:0478"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1534343"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T03:44:11.828Z"}, "title": "CVE Program Container", "references": [{"name": "RHSA-2018:0479", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:0479"}, {"name": "RHSA-2018:0481", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:0481"}, {"name": "RHSA-2018:0480", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:0480"}, {"name": "RHSA-2018:0478", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:0478"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1534343"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2018-1048", "dateReserved": "2017-12-04T00:00:00", "dateUpdated": "2024-08-05T03:44:11.828Z", "state": "PUBLISHED", "datePublished": "2018-01-24T23:00:00Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "868C0845-F25C-487F-A697-72917BE9D78E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files."}, {"lang": "es", "value": "Se ha descubierto que el conector AJP en undertow, tal y como se incluye en Jboss EAP 7.1.0.GA, no emplea la opci\u00f3n ALLOW_ENCODED_SLASH y, por lo tanto, permite que los caracteres barra diagonal / barra diagonal invertida se cifren en la url, lo que podr\u00eda conducir a un salto de directorio y resulta en la revelaci\u00f3n de informaci\u00f3n de archivos locales arbitrarios."}], "id": "CVE-2018-1048", "lastModified": "2024-11-21T03:59:03.983", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-01-24T23:29:00.607", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0478"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0479"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0480"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0481"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1534343"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0478"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0479"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0480"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:0481"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1534343"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-116"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2018:0478", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "impact": "moderate", "package": "undertow", "product_name": "Red Hat JBoss EAP 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-activemq-artemis-0:1.5.5.009-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-apache-cxf-0:3.1.13-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-glassfish-jsf-0:2.2.13-6.SP5_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-hibernate-0:5.1.12-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-infinispan-0:8.2.9-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-ironjacamar-0:1.4.7-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-jackson-annotations-0:2.8.11-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-jackson-core-0:2.8.11-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-jackson-databind-0:2.8.11-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-jackson-jaxrs-providers-0:2.8.11-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-jackson-module-jaxb-annotations-0:2.8.11-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-jackson-modules-java8-0:2.8.11-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-jboss-logmanager-0:2.0.8-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-jboss-server-migration-0:1.0.3-6.Final_redhat_6.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-jbossws-cxf-0:5.1.10-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-narayana-0:5.5.31-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-picketlink-bindings-0:2.5.5-10.SP9_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-picketlink-federation-0:2.5.5-10.SP9_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-resteasy-0:3.0.25-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-undertow-0:1.4.18-4.SP2_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-undertow-jastow-0:2.0.3-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-wildfly-0:7.1.1-4.GA_redhat_2.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-wildfly-elytron-0:1.1.8-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-wildfly-http-client-0:1.0.9-1.Final_redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-wildfly-javadocs-0:7.1.1-3.GA_redhat_2.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-wss4j-0:2.1.11-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0479", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-xml-security-0:2.0.9-1.redhat_1.1.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0481", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6", "impact": "moderate", "package": "eap7-jboss-ec2-eap-0:7.1.1-3.1.GA_redhat_3.ep7.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-activemq-artemis-0:1.5.5.009-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-apache-cxf-0:3.1.13-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-glassfish-jsf-0:2.2.13-6.SP5_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-hibernate-0:5.1.12-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-infinispan-0:8.2.9-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-ironjacamar-0:1.4.7-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-jackson-annotations-0:2.8.11-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-jackson-core-0:2.8.11-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-jackson-databind-0:2.8.11-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-jackson-jaxrs-providers-0:2.8.11-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-jackson-module-jaxb-annotations-0:2.8.11-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-jackson-modules-java8-0:2.8.11-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-jboss-logmanager-0:2.0.8-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-jboss-server-migration-0:1.0.3-6.Final_redhat_6.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-jbossws-cxf-0:5.1.10-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-narayana-0:5.5.31-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-picketlink-bindings-0:2.5.5-10.SP9_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-picketlink-federation-0:2.5.5-10.SP9_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-resteasy-0:3.0.25-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-undertow-0:1.4.18-4.SP2_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-undertow-jastow-0:2.0.3-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-wildfly-0:7.1.1-4.GA_redhat_2.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-wildfly-elytron-0:1.1.8-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-wildfly-http-client-0:1.0.9-1.Final_redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-wildfly-javadocs-0:7.1.1-3.GA_redhat_2.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-wss4j-0:2.1.11-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0480", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-xml-security-0:2.0.9-1.redhat_1.1.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}, {"advisory": "RHSA-2018:0481", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7", "impact": "moderate", "package": "eap7-jboss-ec2-eap-0:7.1.1-3.1.GA_redhat_3.ep7.el7", "product_name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7", "release_date": "2018-03-12T00:00:00Z"}], "bugzilla": {"description": "undertow: ALLOW_ENCODED_SLASH option not taken into account in the AjpRequestParser", "id": "1534343", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1534343"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.6", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-22", "details": ["It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files.", "It was found that the AJP connector in undertow does not use the ALLOW_ENCODED_SLASH option and thus allows the slash and anti-slash characters encoded in a URL. This may lead to path traversal and result in the information disclosure of arbitrary local files."], "name": "CVE-2018-1048", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "Karaf", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:6", "fix_state": "Will not fix", "package_name": "Karaf", "product_name": "Red Hat JBoss Fuse 6"}, {"cpe": "cpe:/a:redhat:fuse_integration_services:2", "fix_state": "Affected", "package_name": "undetow", "product_name": "Red Hat JBoss Fuse Integration Service 2"}], "public_date": "2018-01-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2018-1048\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-1048"], "threat_severity": "Moderate"}