CVE-2016-0793 in the critical feed json
WildFly has incomplete blacklist vulnerability
published 2016-04-01 10 y ago modified 2026-06-17 4 mo ago also GHSA-9q87-22gr-r8qf , EUVD-2016-0804
- cvss
- 7.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 15.0%
- EPSS 15.0% chance of exploitation in 30 days, percentile 96%
- public exploits
- 1
- Exploit-DB
Summary
Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.
Patch / fix
- maven org.wildfly:wildfly-parent 10.0.0.Final
- maven org.wildfly:wildfly-undertow 10.0.0.Final
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2016-0793 updated cvss 5.0
wildfly: WEB-INF and META-INF Information Disclosure via Filter Restriction Bypass
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (EDB-39573)
- Published
Exploit prediction
14.97% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-39573 Wildfly - 'WEB-INF' / 'META-INF' Information Disclosure via Filter Restriction Bypass webapps, 2016-03-20
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.wildfly:wildfly-parent | <10.0.0.Final |
10.0.0.Final |
| maven | org.wildfly:wildfly-undertow | <10.0.0.Final |
10.0.0.Final |
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
exploit-db.com
/exploits/39573/
exploit
-
bugzilla.redhat.com
/show_bug.cgi?id=1305937
web, vendor-advisory
-
support.hpe.com
/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03784en_us
web
-
packetstormsecurity.com
/files/136323/Wildfly-Filter-Restriction-Bypass-Information-Disclosure.html
web
- security.netapp.com /advisory/ntap-20180215-0001/
-
nvd.nist.gov
/vuln/detail/CVE-2016-0793
advisory
-
github.com
/wildfly/wildfly
package
-
security.netapp.com
/advisory/ntap-20180215-0001
web
-
exploit-db.com
/exploits/39573
web
Sources
- CVE List CVE-2016-0793
- GitHub Advisory GHSA-9q87-22gr-r8qf
- NVD CVE-2016-0793
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.