Read the docs
TI-2016-00710 Aliases CVE-2016-0793GHSA-9q87-22gr-r8qf

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly…

Priority MEDIUM 49CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.

Why it matters now

EPSS 0.14971 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed org.wildfly:wildfly-parent (Maven): 10.0.0.Finalorg.wildfly:wildfly-undertow (Maven): 10.0.0.Final

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.wildfly:wildfly-parent (Maven)before 10.0.0.Final10.0.0.FinalPatch availableGHSA-9q87-22gr-r8qf
—org.wildfly:wildfly-undertow (Maven)before 10.0.0.Final10.0.0.FinalPatch availableGHSA-9q87-22gr-r8qf
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.wildfly:wildfly-parent (Maven) Vendor— Affected before 10.0.0.Final Fixed in 10.0.0.Final Patch available GHSA-9q87-22gr-r8qf
  • org.wildfly:wildfly-undertow (Maven) Vendor— Affected before 10.0.0.Final Fixed in 10.0.0.Final Patch available GHSA-9q87-22gr-r8qf

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_wildfly_application_server:10.0.0:*:*:*:*:*:*:*10.0.0VulnerableRed Hat
cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*all versionsRunning onMicrosoft
  • cpe:2.3:a:redhat:jboss_wildfly_application_server:10.0.0:*:*:*:*:*:*:* Versions 10.0.0 Vulnerable ·Red Hat
  • cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft

Remediation

  • Fix · GHSA-9q87-22gr-r8qf org.wildfly:wildfly-parent (Maven) Fixed in 10.0.0.Final Advisory →
  • Fix · GHSA-9q87-22gr-r8qf org.wildfly:wildfly-undertow (Maven) Fixed in 10.0.0.Final Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-0793
  2. 2026-10-03 Alias added: GHSA-9q87-22gr-r8qf

References

Exploit 1

Advisory 2

Other 6

  • TI-2016-07810 Uncontrolled resource consumption in Red Hat wildfly CVSS 3.0HIGH 7.5
  • TI-2015-02829 The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows… CVSS 3.0HIGH 7.5
  • TI-2016-04313 CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red… CVSS 3.0MEDIUM 6.1
  • TI-2015-04356 Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red… CVSS 2.0MEDIUM 6.8
  • TI-2015-04382 The Web Console in Red Hat Enterprise Application Platform (EAP) before 6.4.4 and WildFly… CVSS 2.0MEDIUM 5.0
  • TI-2018-00968 Improper input validation in Red Hat Wildfly CVSS 3.0MEDIUM 5.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences