CVE-2018-10682
First published: Wed May 09 2018(Updated: )
** DISPUTED ** An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication using "anonymous" access that is automatically created. Once logged in, a misconfiguration present by default (auto-deployment) permits an anonymous user to deploy a malicious .war file, leading to remote code execution. NOTE: the vendor indicates that anonymous access is not available in the default installation; however, it remains optional because there are several use cases for it, including development environments and network architectures that have a proxy server for access control to the WildFly server.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat JBoss WildFly Application Server | =10.1.2-final |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2018-10682?
CVE-2018-10682 is considered a critical vulnerability due to the potential for unauthorized access to sensitive administration functions.
How do I fix CVE-2018-10682?
To fix CVE-2018-10682, disable anonymous access to the administration console and ensure proper authentication is enforced.
What software versions are affected by CVE-2018-10682?
CVE-2018-10682 affects WildFly version 10.1.2.Final specifically.
What kind of attack does CVE-2018-10682 allow?
CVE-2018-10682 allows attackers to gain unauthorized access to the administration panel without requiring authentication.
Can CVE-2018-10682 lead to further exploitation?
Yes, exploiting CVE-2018-10682 can lead to potential further attacks due to misconfiguration and auto-deployment features.
- agent/type
- agent/weakness
- agent/references
- agent/status
- agent/softwarecombine
- agent/description
- agent/first-publish-date
- agent/severity
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- status/disputed
- vendor/wildfly
- canonical/red hat jboss wildfly application server
- version/red hat jboss wildfly application server/10.1.2-final