Vulnerability-Lookup

CVE-2018-10862 (GCVE-0-2018-10862)

Vulnerability from cvelistv5 – Published: 2018-07-27 14:00 – Updated: 2024-08-05 07:46

Summary

WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.

Severity

5.5 (Medium)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE

Assigner

redhat CNA under the redhat root

CNA scorecard B 81/100 over 1014 records in the last 180 days details

References

11 references

URL	Tags
https://snyk.io/research/zip-slip-vulnerability	x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2…	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:2428	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:2643	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:2279	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:2424	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:2276	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:2423	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:2425	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:2277	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:0877	vendor-advisoryx_refsource_REDHAT

Date Public

2018-06-20 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:46:47.486Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://snyk.io/research/zip-slip-vulnerability"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862"
          },
          {
            "name": "RHSA-2018:2428",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2428"
          },
          {
            "name": "RHSA-2018:2643",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2643"
          },
          {
            "name": "RHSA-2018:2279",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2279"
          },
          {
            "name": "RHSA-2018:2424",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2424"
          },
          {
            "name": "RHSA-2018:2276",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2276"
          },
          {
            "name": "RHSA-2018:2423",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2423"
          },
          {
            "name": "RHSA-2018:2425",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2425"
          },
          {
            "name": "RHSA-2018:2277",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2277"
          },
          {
            "name": "RHSA-2019:0877",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:0877"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-06-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the \u0027Zip Slip\u0027 vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-04-24T21:06:03.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://snyk.io/research/zip-slip-vulnerability"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862"
        },
        {
          "name": "RHSA-2018:2428",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2428"
        },
        {
          "name": "RHSA-2018:2643",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2643"
        },
        {
          "name": "RHSA-2018:2279",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2279"
        },
        {
          "name": "RHSA-2018:2424",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2424"
        },
        {
          "name": "RHSA-2018:2276",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2276"
        },
        {
          "name": "RHSA-2018:2423",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2423"
        },
        {
          "name": "RHSA-2018:2425",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2425"
        },
        {
          "name": "RHSA-2018:2277",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2277"
        },
        {
          "name": "RHSA-2019:0877",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:0877"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-10862",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the \u0027Zip Slip\u0027 vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://snyk.io/research/zip-slip-vulnerability",
              "refsource": "MISC",
              "url": "https://snyk.io/research/zip-slip-vulnerability"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862"
            },
            {
              "name": "RHSA-2018:2428",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2428"
            },
            {
              "name": "RHSA-2018:2643",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2643"
            },
            {
              "name": "RHSA-2018:2279",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2279"
            },
            {
              "name": "RHSA-2018:2424",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2424"
            },
            {
              "name": "RHSA-2018:2276",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2276"
            },
            {
              "name": "RHSA-2018:2423",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2423"
            },
            {
              "name": "RHSA-2018:2425",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2425"
            },
            {
              "name": "RHSA-2018:2277",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2277"
            },
            {
              "name": "RHSA-2019:0877",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:0877"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-10862",
    "datePublished": "2018-07-27T14:00:00.000Z",
    "dateReserved": "2018-05-09T00:00:00.000Z",
    "dateUpdated": "2024-08-05T07:46:47.486Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2018-10862",
      "date": "2026-10-14",
      "epss": "0.01262",
      "percentile": "0.69083"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6BBD7A51-0590-4DDF-8249-5AFA8D645CB6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "868C0845-F25C-487F-A697-72917BE9D78E",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "868C0845-F25C-487F-A697-72917BE9D78E",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:redhat:wildfly_core:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "63F50451-C638-4975-8F48-A303C4D83B5B",
                  "versionEndIncluding": "5.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:wildfly_core:6.0.0:alpha1:*:*:*:*:*:*",
                  "matchCriteriaId": "41F9734C-F9ED-4DAA-AE32-4F1753360039",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:redhat:wildfly_core:6.0.0:alpha2:*:*:*:*:*:*",
                  "matchCriteriaId": "E601F1DC-ABB5-46DA-B124-AB08F3069A36",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the \u0027Zip Slip\u0027 vulnerability."
        },
        {
          "lang": "es",
          "value": "WildFly Core en versiones anteriores a la 6.0.0.0.Alpha3 no valida correctamente las rutas de los archivos en los archivos .war, lo que permite la extracci\u00f3n de archivos .war manipulados para sobrescribir archivos arbitrarios.  Este es un ejemplo de la vulnerabilidad \u0027Zip Slip\u0027."
        }
      ],
      "id": "CVE-2018-10862",
      "lastModified": "2024-11-21T03:42:10.053",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "MEDIUM",
              "accessVector": "NETWORK",
              "authentication": "SINGLE",
              "availabilityImpact": "PARTIAL",
              "baseScore": 4.9,
              "confidentialityImpact": "NONE",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:P",
              "version": "2.0"
            },
            "exploitabilityScore": 6.8,
            "impactScore": 4.9,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": true
          }
        ],
        "cvssMetricV30": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.0"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2018-07-27T14:29:00.300",
      "references": [
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2276"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2277"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2279"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2423"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2424"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2425"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2428"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2643"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:0877"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Issue Tracking",
            "Vendor Advisory"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://snyk.io/research/zip-slip-vulnerability"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2276"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2277"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2279"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2423"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2424"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2425"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2428"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2643"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:0877"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Issue Tracking",
            "Vendor Advisory"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://snyk.io/research/zip-slip-vulnerability"
        }
      ],
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-22"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6BBD7A51-0590-4DDF-8249-5AFA8D645CB6",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "868C0845-F25C-487F-A697-72917BE9D78E",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "868C0845-F25C-487F-A697-72917BE9D78E",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:redhat:wildfly_core:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "63F50451-C638-4975-8F48-A303C4D83B5B",
                    "versionEndIncluding": "5.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:wildfly_core:6.0.0:alpha1:*:*:*:*:*:*",
                    "matchCriteriaId": "41F9734C-F9ED-4DAA-AE32-4F1753360039",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:redhat:wildfly_core:6.0.0:alpha2:*:*:*:*:*:*",
                    "matchCriteriaId": "E601F1DC-ABB5-46DA-B124-AB08F3069A36",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the \u0027Zip Slip\u0027 vulnerability."
          },
          {
            "lang": "es",
            "value": "WildFly Core en versiones anteriores a la 6.0.0.0.Alpha3 no valida correctamente las rutas de los archivos en los archivos .war, lo que permite la extracci\u00f3n de archivos .war manipulados para sobrescribir archivos arbitrarios.  Este es un ejemplo de la vulnerabilidad \u0027Zip Slip\u0027."
          }
        ],
        "id": "CVE-2018-10862",
        "lastModified": "2024-11-21T03:42:10.053",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 4.9,
                "confidentialityImpact": "NONE",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 6.8,
              "impactScore": 4.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": true
            }
          ],
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.0"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2018-07-27T14:29:00.300",
        "references": [
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2276"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2277"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2279"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2423"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2424"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2425"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2428"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2643"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:0877"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Issue Tracking",
              "Vendor Advisory"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://snyk.io/research/zip-slip-vulnerability"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2276"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2277"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2279"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2423"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2424"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2425"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2428"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2643"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:0877"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Issue Tracking",
              "Vendor Advisory"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://snyk.io/research/zip-slip-vulnerability"
          }
        ],
        "sourceIdentifier": "secalert@redhat.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-06-28T06:47:20+00:00",
      "cve": "CVE-2018-10862",
      "id": "CVE-2018-10862",
      "initial_release_date": "2018-06-21T00:00:00+00:00",
      "product_status:fixed": "306",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "8",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-10862.json",
      "version": "3"
    }
  }
}

CNVD-2018-15902

Vulnerability from cnvd - Published: 2018-08-22

Title

Red Hat WildFly Core任意文件覆盖漏洞

Description

Red Hat WildFly Core（前称JBoss Application Server）是美国红帽（Red Hat）公司的一款基于JavaEE的开源应用服务器。 Red Hat WildFly Core 6.0.0.Alpha3之前版本中存在任意文件覆盖漏洞，该漏洞源于程序未能正确的验证.war归档文件中的文件路径。攻击者可利用该漏洞覆盖任意文件。

Severity

中

Patch Name

Red Hat WildFly Core任意文件覆盖漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/wildfly/wildfly-core

Reference

https://access.redhat.com/errata/RHSA-2018:2276

Impacted products

Name
Red Hat WildFly Core <6.0.0.Alpha3

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-10862"
    }
  },
  "description": "Red Hat WildFly Core\uff08\u524d\u79f0JBoss Application Server\uff09\u662f\u7f8e\u56fd\u7ea2\u5e3d\uff08Red Hat\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u57fa\u4e8eJavaEE\u7684\u5f00\u6e90\u5e94\u7528\u670d\u52a1\u5668\u3002\r\n\r\nRed Hat WildFly Core 6.0.0.Alpha3\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u4efb\u610f\u6587\u4ef6\u8986\u76d6\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u7684\u9a8c\u8bc1.war\u5f52\u6863\u6587\u4ef6\u4e2d\u7684\u6587\u4ef6\u8def\u5f84\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8986\u76d6\u4efb\u610f\u6587\u4ef6\u3002",
  "discovererName": "Unknow",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/wildfly/wildfly-core",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-15902",
  "openTime": "2018-08-22",
  "patchDescription": "Red Hat WildFly Core\uff08\u524d\u79f0JBoss Application Server\uff09\u662f\u7f8e\u56fd\u7ea2\u5e3d\uff08Red Hat\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u57fa\u4e8eJavaEE\u7684\u5f00\u6e90\u5e94\u7528\u670d\u52a1\u5668\u3002\r\n\r\nRed Hat WildFly Core 6.0.0.Alpha3\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u4efb\u610f\u6587\u4ef6\u8986\u76d6\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u7684\u9a8c\u8bc1.war\u5f52\u6863\u6587\u4ef6\u4e2d\u7684\u6587\u4ef6\u8def\u5f84\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8986\u76d6\u4efb\u610f\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Red Hat WildFly Core\u4efb\u610f\u6587\u4ef6\u8986\u76d6\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Red Hat WildFly Core \u003c6.0.0.Alpha3"
  },
  "referenceLink": "https://access.redhat.com/errata/RHSA-2018:2276",
  "serverity": "\u4e2d",
  "submitTime": "2018-08-01",
  "title": "Red Hat WildFly Core\u4efb\u610f\u6587\u4ef6\u8986\u76d6\u6f0f\u6d1e"
}

FKIE_CVE-2018-10862

Vulnerability from fkie_nvd - Published: 2018-07-27 14:29 - Updated: 2026-06-17 01:34

Severity

5.5 (Medium) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Summary

References

URL	Tags
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2018:2276	Vendor Advisory
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2018:2277	Vendor Advisory
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2018:2279	Vendor Advisory
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2018:2423	Vendor Advisory
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2018:2424	Vendor Advisory
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2018:2425	Vendor Advisory
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2018:2428	Vendor Advisory
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2018:2643	Vendor Advisory
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2019:0877	Vendor Advisory
secalert@redhat.com	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862	Issue Tracking, Vendor Advisory
secalert@redhat.com	https://snyk.io/research/zip-slip-vulnerability	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2018:2276	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2018:2277	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2018:2279	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2018:2423	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2018:2424	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2018:2425	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2018:2428	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2018:2643	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2019:0877	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862	Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://snyk.io/research/zip-slip-vulnerability	Third Party Advisory

Impacted products

Vendor	Product	Version
redhat	virtualization	4.0
redhat	jboss_enterprise_application_platform	7.1.0
redhat	enterprise_linux	6.0
redhat	jboss_enterprise_application_platform	7.1.0
redhat	enterprise_linux	7.0
redhat	wildfly_core	*
redhat	wildfly_core	6.0.0
redhat	wildfly_core	6.0.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6BBD7A51-0590-4DDF-8249-5AFA8D645CB6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "868C0845-F25C-487F-A697-72917BE9D78E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "868C0845-F25C-487F-A697-72917BE9D78E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:wildfly_core:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "63F50451-C638-4975-8F48-A303C4D83B5B",
              "versionEndIncluding": "5.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:wildfly_core:6.0.0:alpha1:*:*:*:*:*:*",
              "matchCriteriaId": "41F9734C-F9ED-4DAA-AE32-4F1753360039",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:wildfly_core:6.0.0:alpha2:*:*:*:*:*:*",
              "matchCriteriaId": "E601F1DC-ABB5-46DA-B124-AB08F3069A36",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the \u0027Zip Slip\u0027 vulnerability."
    },
    {
      "lang": "es",
      "value": "WildFly Core en versiones anteriores a la 6.0.0.0.Alpha3 no valida correctamente las rutas de los archivos en los archivos .war, lo que permite la extracci\u00f3n de archivos .war manipulados para sobrescribir archivos arbitrarios.  Este es un ejemplo de la vulnerabilidad \u0027Zip Slip\u0027."
    }
  ],
  "id": "CVE-2018-10862",
  "lastModified": "2026-06-17T01:34:47.313",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.9,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-07-27T14:29:00.300",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:2276"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:2277"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:2279"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:2423"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:2424"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:2425"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:2428"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:2643"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2019:0877"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://snyk.io/research/zip-slip-vulnerability"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:2276"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:2277"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:2279"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:2423"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:2424"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:2425"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:2428"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:2643"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2019:0877"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://snyk.io/research/zip-slip-vulnerability"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-W8R2-5J8X-X8J6

Vulnerability from github – Published: 2022-05-14 01:06 – Updated: 2022-06-29 23:30

Summary

Improper Limitation of a Pathname to a Restricted Directory in WildFly

Details

Severity

5.5 (Medium)


                  
                    CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.0.0.Alpha2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.wildfly.core:wildfly-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.0.Alpha3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2018-10862"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-29T23:30:02Z",
    "nvd_published_at": "2018-07-27T14:29:00Z",
    "severity": "MODERATE"
  },
  "details": "WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the \u0027Zip Slip\u0027 vulnerability.",
  "id": "GHSA-w8r2-5j8x-x8j6",
  "modified": "2022-06-29T23:30:02Z",
  "published": "2022-05-14T01:06:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10862"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:2276"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:2277"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:2279"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:2423"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:2424"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:2425"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:2428"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:2643"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2019:0877"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/research/zip-slip-vulnerability"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Limitation of a Pathname to a Restricted Directory in WildFly"
}

GSD-2018-10862

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

Aliases

CVE-2018-10862

Aliases

CVE-2018-10862

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2018-10862",
    "description": "WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the \u0027Zip Slip\u0027 vulnerability.",
    "id": "GSD-2018-10862",
    "references": [
      "https://access.redhat.com/errata/RHSA-2020:2562",
      "https://access.redhat.com/errata/RHSA-2020:2321",
      "https://access.redhat.com/errata/RHSA-2019:0877",
      "https://access.redhat.com/errata/RHSA-2018:2643",
      "https://access.redhat.com/errata/RHSA-2018:2428",
      "https://access.redhat.com/errata/RHSA-2018:2425",
      "https://access.redhat.com/errata/RHSA-2018:2424",
      "https://access.redhat.com/errata/RHSA-2018:2423",
      "https://access.redhat.com/errata/RHSA-2018:2279",
      "https://access.redhat.com/errata/RHSA-2018:2277",
      "https://access.redhat.com/errata/RHSA-2018:2276"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2018-10862"
      ],
      "details": "WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the \u0027Zip Slip\u0027 vulnerability.",
      "id": "GSD-2018-10862",
      "modified": "2023-12-13T01:22:40.886724Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2018-10862",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the \u0027Zip Slip\u0027 vulnerability."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://snyk.io/research/zip-slip-vulnerability",
            "refsource": "MISC",
            "url": "https://snyk.io/research/zip-slip-vulnerability"
          },
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862",
            "refsource": "CONFIRM",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862"
          },
          {
            "name": "RHSA-2018:2428",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2018:2428"
          },
          {
            "name": "RHSA-2018:2643",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2018:2643"
          },
          {
            "name": "RHSA-2018:2279",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2018:2279"
          },
          {
            "name": "RHSA-2018:2424",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2018:2424"
          },
          {
            "name": "RHSA-2018:2276",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2018:2276"
          },
          {
            "name": "RHSA-2018:2423",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2018:2423"
          },
          {
            "name": "RHSA-2018:2425",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2018:2425"
          },
          {
            "name": "RHSA-2018:2277",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2018:2277"
          },
          {
            "name": "RHSA-2019:0877",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2019:0877"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,6.0.0.Alpha2]",
          "affected_versions": "All versions up to 6.0.0.alpha2",
          "cvss_v2": "AV:N/AC:M/Au:S/C:N/I:P/A:P",
          "cvss_v3": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-22",
            "CWE-937"
          ],
          "date": "2022-06-29",
          "description": "WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the \u0027Zip Slip\u0027 vulnerability.",
          "fixed_versions": [
            "6.0.0.Alpha3"
          ],
          "identifier": "CVE-2018-10862",
          "identifiers": [
            "GHSA-w8r2-5j8x-x8j6",
            "CVE-2018-10862"
          ],
          "not_impacted": "All versions after 6.0.0.alpha2",
          "package_slug": "maven/org.wildfly.core/wildfly-server",
          "pubdate": "2022-05-14",
          "solution": "Upgrade to version 6.0.0.Alpha3 or above.",
          "title": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2018-10862",
            "https://access.redhat.com/errata/RHSA-2018:2276",
            "https://access.redhat.com/errata/RHSA-2018:2277",
            "https://access.redhat.com/errata/RHSA-2018:2279",
            "https://access.redhat.com/errata/RHSA-2018:2423",
            "https://access.redhat.com/errata/RHSA-2018:2424",
            "https://access.redhat.com/errata/RHSA-2018:2425",
            "https://access.redhat.com/errata/RHSA-2018:2428",
            "https://access.redhat.com/errata/RHSA-2018:2643",
            "https://access.redhat.com/errata/RHSA-2019:0877",
            "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862",
            "https://snyk.io/research/zip-slip-vulnerability",
            "https://github.com/advisories/GHSA-w8r2-5j8x-x8j6"
          ],
          "uuid": "c95e6e3a-e756-48eb-9300-0f644c6c30fd"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:redhat:wildfly_core:6.0.0:alpha1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:wildfly_core:6.0.0:alpha2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:wildfly_core:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "5.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-10862"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the \u0027Zip Slip\u0027 vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-22"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://snyk.io/research/zip-slip-vulnerability",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://snyk.io/research/zip-slip-vulnerability"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862",
              "refsource": "CONFIRM",
              "tags": [
                "Issue Tracking",
                "Vendor Advisory"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862"
            },
            {
              "name": "RHSA-2018:2279",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2018:2279"
            },
            {
              "name": "RHSA-2018:2277",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2018:2277"
            },
            {
              "name": "RHSA-2018:2276",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2018:2276"
            },
            {
              "name": "RHSA-2018:2428",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2018:2428"
            },
            {
              "name": "RHSA-2018:2425",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2018:2425"
            },
            {
              "name": "RHSA-2018:2424",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2018:2424"
            },
            {
              "name": "RHSA-2018:2423",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2018:2423"
            },
            {
              "name": "RHSA-2018:2643",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2018:2643"
            },
            {
              "name": "RHSA-2019:0877",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2019:0877"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.9,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 6.8,
          "impactScore": 4.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2019-04-26T15:08Z",
      "publishedDate": "2018-07-27T14:29Z"
    }
  }
}

RHSA-2018:2276

Vulnerability from csaf_redhat - Published: 2018-07-26 15:49 - Updated: 2026-08-04 21:49

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1 security update

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2018-10862.

CVE-2018-10862

It was found that the explode function of the deployment utility in jboss-cli and console that allows extraction of files from an archive does not perform necessary validation for directory traversal. This can lead to remote code execution.

7.6 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Fixed: 36 products

https://access.redhat.com/errata/RHSA-2018:2276

Open the full advisory

RHSA-2018:2277

Vulnerability from csaf_redhat - Published: 2018-07-26 15:39 - Updated: 2026-08-04 21:49

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1 security update

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2018-10862.

CVE-2018-10862

7.6 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2018:2277

Open the full advisory

RHSA-2018:2279

Vulnerability from csaf_redhat - Published: 2018-07-26 15:49 - Updated: 2026-08-04 21:49

Summary

Red Hat Security Advisory: Red Hat Single Sign-On 7.2 security update

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2018-10862.

CVE-2018-10862

7.6 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2018:2279

Open the full advisory

RHSA-2018:2423

Vulnerability from csaf_redhat - Published: 2018-08-15 11:31 - Updated: 2026-08-04 21:49

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL 6 security update

Severity

Important

Scope

5 vulnerabilities in this advisory, including CVE-2018-10862.

CVE-2018-10862

7.6 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Fixed: 131 products

https://access.redhat.com/errata/RHSA-2018:2423

Open the full advisory

RHSA-2018:2424

Vulnerability from csaf_redhat - Published: 2018-08-15 11:31 - Updated: 2026-08-04 21:49

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL7 security update

Severity

Important

Scope

5 vulnerabilities in this advisory, including CVE-2018-10862.

CVE-2018-10862

7.6 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Fixed: 129 products

https://access.redhat.com/errata/RHSA-2018:2424

Open the full advisory

RHSA-2018:2425

Vulnerability from csaf_redhat - Published: 2018-08-15 11:20 - Updated: 2026-08-04 21:49

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1 security update

Severity

Important

Scope

5 vulnerabilities in this advisory, including CVE-2018-10862.

CVE-2018-10862

7.6 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2018:2425

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2018-10862 (GCVE-0-2018-10862)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour