CVE-2014-7816

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/oss-sec/2014/q4/830
http://www.securityfocus.com/bid/71328
https://bugzilla.redhat.com/show_bug.cgi?id=1157478Vendor Advisory
https://issues.jboss.org/browse/UNDERTOW-338Vendor Advisory
https://issues.jboss.org/browse/WFLY-4020Vendor Advisory
http://seclists.org/oss-sec/2014/q4/830
http://www.securityfocus.com/bid/71328
https://bugzilla.redhat.com/show_bug.cgi?id=1157478Vendor Advisory
https://issues.jboss.org/browse/UNDERTOW-338Vendor Advisory
https://issues.jboss.org/browse/WFLY-4020Vendor Advisory

Timeline

Published: Dec 1, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-78174.6The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to exe CVE-2014-78184.3Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, CVE-2014-78195.0Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.CVE-2014-78214.0OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a CVE-2014-78227.2The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum siz CVE-2014-78235.0The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MI CVE-2014-78242.1D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (preven CVE-2014-78257.8kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the perf sub CVE-2014-78267.8kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the ftrace s CVE-2014-78273.5The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform CVE-2014-78283.5FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the tw CVE-2014-78295.0Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21,