CVE-2018-10862

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jul 27, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-108637.5It was discovered that redhat-certification 7 is not properly configured and it lists all files and directories in the /var/www/rhcert/storeCVE-2018-108646.2An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. A remote attacker mayCVE-2018-108657.5It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthentiCVE-2018-108669.1It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthentiCVE-2018-108679.1Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove anCVE-2018-108687.5redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticaCVE-2018-108697.5redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any fiCVE-2018-10877.8kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in theCVE-2018-108709.8redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwritCVE-2018-108717.2389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica anCVE-2018-108725.5A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. CVE-2018-108738.8A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bou
CVE-2018-10862: Medium severity, CVSS 5.5 | Vulnix