CVE-2015-3198 The Undertow module of WildFly allows source code disclosure
Remote attackers can obtain JSP source code by appending a slash to the URL, exposing sensitive application logic in WildFly.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-3198?
CVE-2015-3198 is a high-severity vulnerability in n/a, published on 21 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL.
Weakness: CWE-200
Which versions are affected by CVE-2015-3198?
2 open source packages ship an affected version, including org.wildfly:wildfly-parent. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.wildfly:wildfly-parent Maven | From 8.1.0.Final | 9.0.0.CR2 |
org.wildfly:wildfly-parent Maven | From 8.1.0.Final | 9.0.0.CR2 |
Products include Redhat Jboss Wildfly Application Server.
How do I fix CVE-2015-3198?
Upgrade org.wildfly:wildfly-parent to 9.0.0.CR2 or later.
Is CVE-2015-3198 being exploited?
There is no known exploitation of CVE-2015-3198 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-4vwv-x3gp-2j4g.