CVE-2015-3198

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugzilla.redhat.com/show_bug.cgi?id=1224787Issue Tracking, Third Party Advisory
https://developer.jboss.org/message/927301#927301Issue Tracking, Third Party Advisory
https://issues.jboss.org/browse/WFLY-4595Third Party Advisory
https://stackoverflow.com/questions/30028346/with-trailing-slash-in-url-jsp-show-source-codeThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1224787Issue Tracking, Third Party Advisory
https://developer.jboss.org/message/927301#927301Issue Tracking, Third Party Advisory
https://issues.jboss.org/browse/WFLY-4595Third Party Advisory
https://stackoverflow.com/questions/30028346/with-trailing-slash-in-url-jsp-show-source-codeThird Party Advisory

Timeline

Published: Jul 21, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-32007.5mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a CVE-2015-32012.1Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credenti CVE-2015-32023.6fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows loc CVE-2015-32037.5Unrestricted file upload vulnerability in h5ai before 0.25.0 allows remote attackers to execute arbitrary code by uploading a file with an e CVE-2015-32045.0libreswan 3.9 through 3.12 allows remote attackers to cause a denial of service (daemon restart) via an IKEv1 packet with (1) unassigned bit CVE-2015-32057.5libmimedir allows remote attackers to execute arbitrary code via a VCF file with two NULL bytes at the end of the file, related to "free" fu CVE-2015-32068.1The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers t CVE-2015-32075.3In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes.CVE-2015-32097.5Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTAT CVE-2015-32109.8Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular CVE-2015-32115.5php-fpm allows local users to write to or create arbitrary files via a symlink attack.CVE-2015-32124.9Race condition in net/sctp/socket.c in the Linux kernel before 4.1.2 allows local users to cause a denial of service (list corruption and pa