CVE-2014-7816: Path Traversal
Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.
Other sources
IssueDescription:
It was discovered that Undertow, when running on Microsoft Windows, is vulnerable to a directory traversal flaw. A remote attacker could use this flaw to read arbitrary files that are accessible to the user running the Java process.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7816?
CVE-2014-7816 is classified as a medium severity vulnerability due to its directory traversal risks.
How do I fix CVE-2014-7816?
To fix CVE-2014-7816, upgrade JBoss Undertow to version 1.0.17 or later, 1.1.0.CR5 or later, or 1.2.0.Beta3 or later.
Which versions of JBoss Undertow are affected by CVE-2014-7816?
JBoss Undertow versions prior to 1.0.17, 1.1.0.CR5, and 1.2.0.Beta3 are affected by CVE-2014-7816.
Can CVE-2014-7816 impact Windows systems?
Yes, CVE-2014-7816 specifically allows directory traversal on JBoss Undertow when running on Windows.
What type of vulnerability is CVE-2014-7816?
CVE-2014-7816 is a directory traversal vulnerability that enables remote attackers to read arbitrary files.