CVE-2018-1048: Improper Encoding or Escaping of Output

May 13, 2022 (updated June 30, 2022)

It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files.

References

access.redhat.com/errata/RHSA-2018:0478
access.redhat.com/errata/RHSA-2018:0479
access.redhat.com/errata/RHSA-2018:0480
access.redhat.com/errata/RHSA-2018:0481
bugzilla.redhat.com/show_bug.cgi?id=1534343
github.com/advisories/GHSA-prfw-3qx6-g9xr
nvd.nist.gov/vuln/detail/CVE-2018-1048

Code Behaviors & Features

Detect and mitigate CVE-2018-1048 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →