wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)
Published Jul 27, 2018
7.6
HIGHCVSS 3.0
EPSS 1.26%
Description
WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.
Affected products
No data.
Configuration 1
- 4.0
Configuration 2
- 7.1.0
Running on/with
- 6.0
Configuration 3
- 7.1.0
Running on/with
- 7.0
Configuration 4
- ≤ 5.0.0
- 6.0.0
- 6.0.0
No data.
Red Hat Data Grid 7.3.6
wildfly
Fixed · RHSA-2020:2321
Red Hat JBoss EAP 7.1
n/a
Fixed · RHSA-2018:2277
Red Hat JBoss EAP 7.1
wildfly
Fixed · RHSA-2018:2425
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-activemq-artemis-0:1.5.5.013-1.redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6
Fixed · RHSA-2018:2276
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-bouncycastle-0:1.56.0-5.redhat_3.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-guava-libraries-0:25.0.0-1.redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-hibernate-0:5.1.15-1.Final_redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-ironjacamar-0:1.4.10-1.Final_redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-jberet-0:1.2.6-2.Final_redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-jboss-ejb-client-0:4.0.11-1.Final_redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-jboss-remoting-0:5.0.8-1.Final_redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-jboss-server-migration-0:1.0.6-4.Final_redhat_4.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-mod_cluster-0:1.3.10-1.Final_redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-narayana-0:5.5.32-1.Final_redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-picketlink-bindings-0:2.5.5-13.SP12_redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-picketlink-federation-0:2.5.5-13.SP12_redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-resteasy-0:3.0.26-1.Final_redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-undertow-0:1.4.18-7.SP8_redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6
Fixed · RHSA-2018:2276
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-wildfly-0:7.1.4-1.GA_redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-wildfly-javadocs-0:7.1.4-2.GA_redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-wildfly-naming-client-0:1.0.9-1.Final_redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-wildfly-openssl-linux-0:1.0.6-14.Final_redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-wildfly-transaction-client-0:1.0.4-1.Final_redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-wildfly-web-console-eap-0:2.9.18-1.Final_redhat_1.1.ep7.el6
Fixed · RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6
Fixed · RHSA-2018:2276
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6
eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6
Fixed · RHSA-2018:2276
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-activemq-artemis-0:1.5.5.013-1.redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7
Fixed · RHSA-2018:2276
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-bouncycastle-0:1.56.0-5.redhat_3.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-guava-libraries-0:25.0.0-1.redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-hibernate-0:5.1.15-1.Final_redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-ironjacamar-0:1.4.10-1.Final_redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-jberet-0:1.2.6-2.Final_redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-jboss-ejb-client-0:4.0.11-1.Final_redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-jboss-remoting-0:5.0.8-1.Final_redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-jboss-server-migration-0:1.0.6-4.Final_redhat_4.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-mod_cluster-0:1.3.10-1.Final_redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-narayana-0:5.5.32-1.Final_redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-picketlink-bindings-0:2.5.5-13.SP12_redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-picketlink-federation-0:2.5.5-13.SP12_redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-resteasy-0:3.0.26-1.Final_redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-undertow-0:1.4.18-7.SP8_redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7
Fixed · RHSA-2018:2276
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-wildfly-0:7.1.4-1.GA_redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-wildfly-javadocs-0:7.1.4-2.GA_redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-wildfly-naming-client-0:1.0.9-1.Final_redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-wildfly-openssl-linux-0:1.0.6-14.Final_redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-wildfly-transaction-client-0:1.0.4-1.Final_redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-wildfly-web-console-eap-0:2.9.18-1.Final_redhat_1.1.ep7.el7
Fixed · RHSA-2018:2424
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7
Fixed · RHSA-2018:2276
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7
Fixed · RHSA-2018:2276
Red Hat JBoss Enterprise Application Platform Continuous Delivery
wildfly
Fixed · RHSA-2020:2562
Red Hat Single Sign-On 7.2
wildfly
Fixed · RHSA-2018:2279
Red Hat Single Sign-On 7.2.4 zip
wildfly
Fixed · RHSA-2018:2428
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
rhvm-appliance-0:4.2-20180828.0.el7
Fixed · RHSA-2018:2643
Text-Only RHOAR
n/a
Fixed · RHSA-2019:0877
JBoss Developer Studio 11
wildfly
Not affected
Red Hat BPM Suite 6
wildfly
Not affected
Red Hat Fuse 7
wildfly
Not affected
Red Hat JBoss BRMS 6
wildfly
Not affected
Red Hat JBoss Data Grid 6
wildfly
Not affected
Red Hat JBoss Data Virtualization 6
wildfly
Out of support scope
Red Hat JBoss Enterprise Application Platform 6
wildfly
Not affected
Red Hat JBoss Fuse 6
wildfly
Not affected
Red Hat JBoss Operations Network 3
wildfly
Not affected
Red Hat OpenShift Application Runtimes
wildfly
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Data Grid 7.3.6 | wildfly | Fixed | RHSA-2020:2321 |
| Red Hat JBoss EAP 7.1 | n/a | Fixed | RHSA-2018:2277 |
| Red Hat JBoss EAP 7.1 | wildfly | Fixed | RHSA-2018:2425 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-activemq-artemis-0:1.5.5.013-1.redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2276 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-bouncycastle-0:1.56.0-5.redhat_3.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-guava-libraries-0:25.0.0-1.redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-hibernate-0:5.1.15-1.Final_redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-ironjacamar-0:1.4.10-1.Final_redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-jberet-0:1.2.6-2.Final_redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-jboss-ejb-client-0:4.0.11-1.Final_redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-jboss-remoting-0:5.0.8-1.Final_redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-jboss-server-migration-0:1.0.6-4.Final_redhat_4.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-mod_cluster-0:1.3.10-1.Final_redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-narayana-0:5.5.32-1.Final_redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-picketlink-bindings-0:2.5.5-13.SP12_redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-picketlink-federation-0:2.5.5-13.SP12_redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-resteasy-0:3.0.26-1.Final_redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-undertow-0:1.4.18-7.SP8_redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6 | Fixed | RHSA-2018:2276 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-wildfly-0:7.1.4-1.GA_redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-wildfly-javadocs-0:7.1.4-2.GA_redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-wildfly-naming-client-0:1.0.9-1.Final_redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-wildfly-openssl-linux-0:1.0.6-14.Final_redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-wildfly-transaction-client-0:1.0.4-1.Final_redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-wildfly-web-console-eap-0:2.9.18-1.Final_redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2423 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2276 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 | eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6 | Fixed | RHSA-2018:2276 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-activemq-artemis-0:1.5.5.013-1.redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2276 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-bouncycastle-0:1.56.0-5.redhat_3.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-guava-libraries-0:25.0.0-1.redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-hibernate-0:5.1.15-1.Final_redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-ironjacamar-0:1.4.10-1.Final_redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-jberet-0:1.2.6-2.Final_redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-jboss-ejb-client-0:4.0.11-1.Final_redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-jboss-remoting-0:5.0.8-1.Final_redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-jboss-server-migration-0:1.0.6-4.Final_redhat_4.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-mod_cluster-0:1.3.10-1.Final_redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-narayana-0:5.5.32-1.Final_redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-picketlink-bindings-0:2.5.5-13.SP12_redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-picketlink-federation-0:2.5.5-13.SP12_redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-resteasy-0:3.0.26-1.Final_redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-undertow-0:1.4.18-7.SP8_redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7 | Fixed | RHSA-2018:2276 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-wildfly-0:7.1.4-1.GA_redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-wildfly-javadocs-0:7.1.4-2.GA_redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-wildfly-naming-client-0:1.0.9-1.Final_redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-wildfly-openssl-linux-0:1.0.6-14.Final_redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-wildfly-transaction-client-0:1.0.4-1.Final_redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-wildfly-web-console-eap-0:2.9.18-1.Final_redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2424 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2276 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 | eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7 | Fixed | RHSA-2018:2276 |
| Red Hat JBoss Enterprise Application Platform Continuous Delivery | wildfly | Fixed | RHSA-2020:2562 |
| Red Hat Single Sign-On 7.2 | wildfly | Fixed | RHSA-2018:2279 |
| Red Hat Single Sign-On 7.2.4 zip | wildfly | Fixed | RHSA-2018:2428 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | rhvm-appliance-0:4.2-20180828.0.el7 | Fixed | RHSA-2018:2643 |
| Text-Only RHOAR | n/a | Fixed | RHSA-2019:0877 |
| JBoss Developer Studio 11 | wildfly | Not affected | n/a |
| Red Hat BPM Suite 6 | wildfly | Not affected | n/a |
| Red Hat Fuse 7 | wildfly | Not affected | n/a |
| Red Hat JBoss BRMS 6 | wildfly | Not affected | n/a |
| Red Hat JBoss Data Grid 6 | wildfly | Not affected | n/a |
| Red Hat JBoss Data Virtualization 6 | wildfly | Out of support scope | n/a |
| Red Hat JBoss Enterprise Application Platform 6 | wildfly | Not affected | n/a |
| Red Hat JBoss Fuse 6 | wildfly | Not affected | n/a |
| Red Hat JBoss Operations Network 3 | wildfly | Not affected | n/a |
| Red Hat OpenShift Application Runtimes | wildfly | Affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
This vulnerability can only be exploited by users with deployment permissions.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1 other source (Red Hat) ▾
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
AV:N/AC:M/Au:S/C:N/I:P/A:P
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (15 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 1.26% (0.01262) | 68.58th | v5 (v2026.06.15) |
| Jun 15, 2026 | 1.26% (0.01262) | 65.70th | v5 (v2026.06.15) |
| Mar 17, 2025 | 0.46% (0.00458) | 61.92th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.06% (0.00059) | 27.15th | v3 (v2023.03.01) |
| Jun 13, 2024 | 0.06% (0.00059) | 25.23th | v3 (v2023.03.01) |
| Jul 21, 2023 | 0.06% (0.00059) | 23.23th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.05% (0.00047) | 14.21th | v3 (v2023.03.01) |
| Mar 6, 2023 | 1.28% (0.01282) | 68.34th | v2 (v2022.01.01) |
| Feb 22, 2023 | 1.28% (0.01282) | 68.05th | v2 (v2022.01.01) |
| Apr 1, 2022 | 1.28% (0.01282) | 65.91th | v2 (v2022.01.01) |
| Feb 4, 2022 | 1.28% (0.01282) | 41.72th | v2 (v2022.01.01) |
| Feb 3, 2022 | 2.48% (0.02476) | 54.92th | v1 |
| Jan 6, 2022 | 2.48% (0.02476) | 54.49th | v1 |
| Sep 1, 2021 | 2.48% (0.02476) | 78.74th | v1 |
| Apr 14, 2021 | 2.48% (0.02476) | 0.00th | v1 |
References (16)
- https://access.redhat.com/errata/RHSA-2018:2276 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2277 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2279 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2423 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2424 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2425 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2428 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2018:2643 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2019:0877 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/security/cve/CVE-2018-10862 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1593527 Issue Tracking
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862 x_refsource_CONFIRMIssue TrackingVendor Advisory
- https://github.com/advisories/GHSA-w8r2-5j8x-x8j6 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-10862
- https://snyk.io/research/zip-slip-vulnerability x_refsource_MISCThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2018-10862
Change history (0)
No recorded changes yet.