Path Traversal Vulnerability in JBoss EAP by Red Hat

CVE-2018-1048

Summary

A security flaw exists in the AJP connector of Undertow, included in JBoss EAP 7.1.0.GA. This vulnerability arises from the absence of the ALLOW_ENCODED_SLASH option, allowing attackers to exploit encoded slash and backslash characters within URLs. This can facilitate path traversal attacks, potentially leading to unauthorized access to arbitrary local files, raising significant security concerns for affected systems.

References