Threats tagged 'ghsa-h5fg-v7p5-v99j'

A path traversal vulnerability exists in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library used by WildFly and JBoss EAP. An attacker with the Deployer RBAC role can exploit this flaw by supplying an unsanitized deployment name containing path traversal sequences, allowing access outside the intended deployment directory. This can lead to deletion of arbitrary directories or creation of files with arbitrary content, resulting in full privilege escalation to the management SuperUser role. A security update addressing this issue is available in Red Hat JBoss Enterprise Application Platform 8.1.9.