Read the docs
TI-2016-06052 Aliases CVE-2016-7041GHSA-h463-ph72-3qqf

Path traversal in Red Hat Drools Workbench

Priority LOW 36CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

Drools Workbench contains a path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host.

Why it matters now

EPSS 0.03956 90th percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 2 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatDrools Workbenchall versions—No fix listedCNA
  • Drools Workbench VendorRed Hat Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_brms:6.3:*:*:*:*:*:*:*6.3VulnerableRed Hat
cpe:2.3:a:redhat:jboss_drools:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_brms:6.3:*:*:*:*:*:*:* Versions 6.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_drools:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat

Remediation

Red Hat 4 advisories

  • RHSA-2016:2937 Released 2016-12-08 · Red Hat rating Moderate
    Red Hat JBoss BPM Suite security update
    • Red Hat JBoss BPMS 6.3
  • RHSA-2016:2938 Released 2016-12-08 · Red Hat rating Moderate
    Red Hat JBoss BRMS security update
    • Red Hat JBoss BRMS 6.3
  • RHSA-2016:2822 Released 2016-11-28 · Red Hat rating Moderate
    Red Hat JBoss BPM Suite security update
    • Red Hat JBoss BPMS 6.3
Show 1 more Red Hat advisories
  • RHSA-2016:2823 Released 2016-11-28 · Red Hat rating Moderate
    Red Hat JBoss BRMS security update
    • Red Hat JBoss BRMS 6.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix yet
Red Hat JBoss BRMS 6AffectedNo fix yet
Red Hat JBoss BPMS 6.3Fixed RHSA-2016:2937
Red Hat JBoss BRMS 6.3Fixed RHSA-2016:2938

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-7041
  2. 2026-10-03 Alias added: GHSA-h463-ph72-3qqf

References

Advisory 5

  • TI-2018-13721 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
  • TI-2018-13720 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
  • TI-2018-13719 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
  • TI-2018-08616 An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and… CVSS 3.1HIGH 7.5
  • TI-2018-08617 An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and… CVSS 3.0HIGH 7.5
  • TI-2012-04729 EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red… CVSS 3.1HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences